Description
OneUptime is a solution for monitoring and managing online services. Prior to 10.0.21, an unauthenticated path traversal in the /workflow/docs/:componentName endpoint allows reading arbitrary files from the server filesystem. The componentName route parameter is concatenated directly into a file path passed to res.sendFile() in orker/FeatureSet/Workflow/Index.ts with no sanitization or authentication middleware. This vulnerability is fixed in 10.0.21.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OneUptime | oneuptime | < 10.0.21 | — |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- OneUptime < 10.0.21 - Path Traversal http/cves/2026/CVE-2026-30958.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.