OneUptime: Path Traversal — Arbitrary File Read (No Auth)

The primary impact of CVE-2026-30958 is the potential for unauthorized access to sensitive data stored on the OneUptime server. An attacker exploiting this vulnerability could read configuration files, database credentials, source code, or any other file accessible to the web server process. This could lead to complete system compromise, data breaches, and further malicious activity. The lack of authentication for the vulnerable endpoint significantly broadens the attack surface, making exploitation relatively straightforward.

Organizations utilizing OneUptime for service monitoring and management, particularly those running versions prior to 10.0.21, are at risk. Shared hosting environments where OneUptime is deployed alongside other applications are especially vulnerable, as a compromise of OneUptime could potentially lead to lateral movement and impact other tenants.

• nodejs / server:

find /var/log/oneuptime -type f -name '*.log' | grep -i "/workflow/docs/" 

• generic web:

curl -I 'http://<oneuptime_ip>/workflow/docs/../../../../etc/passwd' # Attempt to access sensitive files

1. 2026-03-10Disclosure

   disclosure

1. Reserviert2026-03-07
2. Veröffentlicht2026-03-10
3. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2026-30958 is to immediately upgrade OneUptime to version 10.0.21 or later. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to block requests to the /workflow/docs/:componentName endpoint. Alternatively, restrict access to the OneUptime server to trusted networks and implement strict file system permissions to limit the potential damage from a successful exploit. Carefully review the OneUptime configuration to ensure no sensitive data is stored in easily accessible locations. After upgrade, confirm the vulnerability is resolved by attempting to access the /workflow/docs/:componentName endpoint with a crafted componentName parameter; the request should be denied.