CVE Feed

    Dashboard / CVE / CVE-2026-30958

    CVE-2026-30958

    OneUptime is a solution for monitoring and managing online services. Prior to 10.0.21, an unauthenticated path traversal in the /workflow/docs/:componentName endpoint allows reading arbitrary files from the server filesystem. The componentName route parameter is concatenated directly into a file path passed to res.sendFile() in orker/FeatureSet/Workflow/Index.ts with no sanitization or authentication middleware. This vulnerability is fixed in 10.0.21.

    Published:Mar 10, 2026
    Last Modified:Apr 16, 2026
    EPS:Mar 10, 2026
    EPSS Score:0.00156
    CVSS Score:7.2

    Affected Products

    Vendor
    Hackerbay
    Product
    Oneuptime
    Vendor
    Oneuptime
    Product
    Oneuptime

    Exploits

    https://github.com/OneUptime/oneuptime/security/advisories/GHSA-p2wh-9pw8-hvff

    Related CVEs

    CVE-2026-80350 (CVSS 7.1) — OneUptime's webhook target check rejects private and loopback addresses given in IPv4 form and a small set of …
    CVE-2026-35053 (CVSS 9.2) — OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, the Worker servic…
    CVE-2026-34840 (CVSS 8.1) — OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, OneUptime's SAML …
    CVE-2026-34759 (CVSS 9.2) — OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, multiple notifica…
    CVE-2026-34758 (CVSS 9.1) — OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, unauthenticated a…
    CVE-2026-33396 (CVSS 9.9) — OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.35, a low-privileged …
    CVE-2026-33142 (CVSS 8.1) — OneUptime is a solution for monitoring and managing online services. Prior to version 10.0.34, the fix for CVE…
    CVE-2026-33143 (CVSS 8.7) — OneUptime is a solution for monitoring and managing online services. Prior to version 10.0.34, the WhatsApp PO…
    CVE-2026-32598 (CVSS 6.9) — OneUptime is a solution for monitoring and managing online services. Prior to 10.0.24, the password reset flow…
    CVE-2026-32308 (CVSS 7.6) — OneUptime is a solution for monitoring and managing online services. Prior to 10.0.23, the Markdown viewer com…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High