CVE-2026-30958: OneUptime: Path Traversal — Arbitrary File Read (No Auth)
OneUptime is a solution for monitoring and managing online services. Prior to 10.0.21, an unauthenticated path traversal in the /workflow/docs/:componentName endpoint allows reading arbitrary files from the server filesystem. The componentName route parameter is concatenated directly into a file path passed to res.sendFile() in orker/FeatureSet/Workflow/Index.ts with no sanitization or authentication middleware. This vulnerability is fixed in 10.0.21.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OneUptimeto a version that resolves this vulnerability.Fixed in 10.0.21
Event History
Frequently Asked Questions
What is the severity of CVE-2026-30958?
CVE-2026-30958 is a high-severity vulnerability due to its potential for arbitrary file read without authentication.
How do I fix CVE-2026-30958?
To fix CVE-2026-30958, update OneUptime to version 10.0.21 or later.
What impact does CVE-2026-30958 have on my system?
CVE-2026-30958 allows unauthorized users to read arbitrary files from the server filesystem, potentially exposing sensitive data.
Which versions of OneUptime are affected by CVE-2026-30958?
CVE-2026-30958 affects all versions of OneUptime prior to 10.0.21.
Is authentication required to exploit CVE-2026-30958?
No, CVE-2026-30958 can be exploited without any authentication.