Skip to content
OpenAdvisories

Package · npm

uptime-kuma

11 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-32230 Scanner template

    Uptime Kuma is Missing Authorization Checks on Ping Badge Endpoint, Leaks Ping times of monitors without needing to be on a status page

    Uptime Kuma is an open source, self-hosted monitoring tool. From 2.0.0 to 2.1.3 , the GET /api/badge/:id/ping/:duration? endpoint in server/routers/api-router.js does not verify that the requested monitor belongs to a public group. All other badge endpoints c…

    louislam uptime-kuma uptime-kuma npm
  • Medium 6.5
    GHSA-vffh-c9pq-4crh

    Uptime Kuma Server-side Template Injection (SSTI) in Notification Templates Allows Arbitrary File Read

    ### Summary In some Notification types (e.g., Webhook, Telegram), the `send()` function allows user-controlled renderTemplate input. This leads to a Server-side Template Injection (SSTI) vulnerability that can be exploited to read arbitrary files from the ser…

    uptime-kuma npm
  • Medium 6.0
    CVE-2025-26042

    Uptime Kuma's Regular Expression in pushdeeer and whapi file Leads to ReDoS Vulnerability Due to Catastrophic Backtracking

    Uptime Kuma >== 1.23.0 has a ReDoS vulnerability, specifically when an administrator creates a notification through the web service. If a string is provided it triggers catastrophic backtracking in the regular expression, leading to a ReDoS attack.

    uptime-kuma npm
  • Medium 6.8
    CVE-2024-56331 Public exploit

    Local File Inclusion (LFI) via Improper URL Handling in uptime-kuma's `Real-Browser` monitor

    Uptime Kuma is an open source, self-hosted monitoring tool. An **Improper URL Handling Vulnerability** allows an attacker to access sensitive local files on the server by exploiting the `file:///` protocol. This vulnerability is triggered via the **"real-brow…

    louislam uptime-kuma uptime-kuma npm
  • Medium 6.7
    CVE-2023-49804

    Uptime Kuma Password Change Vulnerability

    Uptime Kuma is an easy-to-use self-hosted monitoring tool. Prior to version 1.23.9, when a user changes their login password in Uptime Kuma, a previously logged-in user retains access without being logged out. This behavior persists consistently, even after s…

    louislam uptime-kuma uptime-kuma npm
  • Medium 6.3
    CVE-2023-49276

    Attribute Injection leading to XSS(Cross-Site-Scripting) in uptime-kuma

    Uptime Kuma is an open source self-hosted monitoring tool. In affected versions the Google Analytics element in vulnerable to Attribute Injection leading to Cross-Site-Scripting (XSS). Since the custom status interface can set an independent Google Analytics …

    louislam uptime-kuma uptime-kuma npm
  • Medium —
    GHSA-hfxh-rjv7-2369

    Uptime Kuma Authenticated remote code execution via TailscalePing

    ### Summary The `runTailscalePing` method of the `TailscalePing` class injects the `hostname` parameter inside a shell command, leading to a command injection and the possibility to run arbitrary commands on the server. ### Details When adding a new monitor o…

    uptime-kuma npm
  • Medium 6.7
    CVE-2023-44400

    Uptime Kuma has Persistentent User Sessions

    Uptime Kuma is a self-hosted monitoring tool. Prior to version 1.23.3, attackers with access to a user's device can gain persistent account access. This is caused by missing verification of Session Tokens after password changes and/or elapsed inactivity perio…

    louislam uptime-kuma uptime-kuma npm
  • Medium 6.5
    CVE-2023-36822

    Uptime Kuma authenticated path traversal via plugin repository name may lead to unavailability or data loss

    Uptime Kuma, a self-hosted monitoring tool, has a path traversal vulnerability in versions prior to 1.22.1. Uptime Kuma allows authenticated users to install plugins from an official list of plugins. This feature is currently disabled in the web interface, bu…

    louislam uptime-kuma uptime-kuma npm