ZeroDay Findings
Sign inSign up

Findings

CVE-2026-30958

OneUptime is a solution for monitoring and managing online services.

Published Mar 10, 2026 · updated Oct 7, 2026 · hackerbay oneuptime

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.21, an unauthenticated path traversal in the /workflow/docs/:componentName endpoint allows reading arbitrary files from the server filesystem. The componentName route parameter is concatenated directly into a file path passed to res.sendFile() in orker/FeatureSet/Workflow/Index.ts with no sanitization or authentication middleware. This vulnerability is fixed in 10.0.21.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 10, 2026 · NIST NVD

    Detected

    OneUptime is a solution for monitoring and managing online services. Prior to 10.0.21, an unauthenticated path traversal in the /workflow/docs/:componentName endpoint allows reading arbitrary files from the server filesystem. The componentName route parameter is concatenated directly into a file path passed to res.sendFile() in orker/FeatureSet/Workflow/Index.ts with no sanitization or authenticat

  2. Oct 7, 2026 · NIST NVD

    Updated

    OneUptime is a solution for monitoring and managing online services. Prior to 10.0.21, an unauthenticated path traversal in the /workflow/docs/:componentName endpoint allows reading arbitrary files from the server filesystem. The componentName route parameter is concatenated directly into a file path passed to res.sendFile() in orker/FeatureSet/Workflow/Index.ts with no sanitization or authenticat

Affected

  • cpe hackerbay/oneuptimeversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-30958

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-30958

    OneUptime is a solution for monitoring and managing online services. Prior to 10.0.21, an unauthenticated path traversal in the /workflow/docs/:componentName endpoint allows reading arbitrary files from the server filesystem. The componentName route parameter is concatenated dire

    nvd.nist.gov

References