Uptime Kuma vulnerabilities

Uptime Kuma through 2.5.8 contains a race condition in the Socket.IO first-run setup handler that allows unauthenticated attackers to create an additional administrator account. Attackers can send concurrent setup requests during the bcrypt hashing window to bypass the empty user table check, then modify monitors, API keys, and enable disableAuth.

Uptime Kuma's Matomo analytics integration injects the admin-configurable Matomo value as a bare, unquoted JavaScript expression inside a <script> block rendered on every public status page. A siteId value such as , once saved by an editor/admin, executes arbitrary JavaScript for every unauthenticated visitor of the public /status/<slug> page, enabling session-cookie theft and full page takeover.

Uptime Kuma, a monitoring tool, has a path traversal vulnerability in versions prior to 1.22.1. This allows authenticated users to delete files from the server, potentially leading to data loss and system unavailability.

Uptime Kuma, a monitoring tool, allows an authenticated attacker to install a maliciously crafted plugin in versions prior to 1.22.1, which may lead to remote code execution. Although the plugin installation feature is currently disabled in the web interface, the corresponding API endpoints are still available after login.