CVE-2026-30958CWE-22path-traversal

CVE-2026-30958

High · published March 10, 2026

CVSS v3.1
7.2
EPSS
1%
Percentile
66.3
In the wild
Unconfirmed
What it is

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.21, an unauthenticated path traversal in the /workflow/docs/:componentName endpoint allows reading arbitrary files from the server filesystem. The componentName route parameter is concatenated directly into a file path passed to res.sendFile() in orker/FeatureSet/Workflow/Index.ts with no sanitization or authentication middleware. This vulnerability is fixed in 10.0.21.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.01139 · 66.3th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-03-10T22:18Z
Affected products (1)
ProductVersionsFixed in
hackerbay/oneuptime< 10.0.2110.0.21
References (2)
https://github.com/OneUptime/oneuptime/releases/tag/10.0.21 · [email protected]https://github.com/OneUptime/oneuptime/security/advisories/GHSA-p2wh-9pw8-hvff · [email protected]
EPSS history
Timeline
  • 10 MAR 17:01Z
    OneUptime: Path Traversal — Arbitrary File Read (No Auth)
    cvelistv5