CVE-2026-30958

HighCVSS 8.6/10Last modified Oct 7, 2026

Description

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.21, an unauthenticated path traversal in the /workflow/docs/:componentName endpoint allows reading arbitrary files from the server filesystem. The componentName route parameter is concatenated directly into a file path passed to res.sendFile() in orker/FeatureSet/Workflow/Index.ts with no sanitization or authentication middleware. This vulnerability is fixed in 10.0.21.

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Mar 10, 2026
Last modified
Oct 7, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-309595.0OneUptime is a solution for monitoring and managing online services. The resend-verification-code endpoint allows any authenticated user to CVE-2026-30964.7The product's web portals allow external links to be opened in a new browser tab. In certain configurations, the originating window retains CVE-2026-309609.4rssn is a scientific computing library for Rust, combining a high-performance symbolic computation engine with numerical methods support andCVE-2026-309614.3Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to 2.2.4, the chunked upload completion CVE-2026-309626.5Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.6 and 8.6.19, tCVE-2026-309632.7Capsule is a multi-tenancy and policy-based framework for Kubernetes. To defend against namespace hijacking achieved through update/patch opCVE-2026-309645.4web-auth/webauthn-lib is an open source set of PHP libraries and a Symfony bundle to allow developers to integrate that authentication mechaCVE-2026-309659.1Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.8 and 8.6.21, aCVE-2026-3096610.0Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.7 and 8.6.20, PCVE-2026-309678.8Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.9. and 8.6.22, CVE-2026-309689.8Coral Server is open collaboration infrastructure that enables communication, coordination, trust and payments for The Internet of Agents. PCVE-2026-309699.1Coral Server is open collaboration infrastructure that enables communication, coordination, trust and payments for The Internet of Agents. P