CVE-2026-30958 Scanner
CVE-2026-30958 Scanner - Path Traversal vulnerability in OneUptime
Used 2.2k times · 3.4k assets checked · url
CVE
CVE-2026-30958
8.6
CVSShigh
Exploitable remotely over the internet · no authentication required.
Description
OneUptime is a solution for monitoring and managing online services. Prior to 10.0.21, an unauthenticated path traversal in the /workflow/docs/:componentName endpoint allows reading arbitrary files from the server filesystem. The componentName route parameter is concatenated directly into a file path passed to res.sendFile() in orker/FeatureSet/Workflow/Index.ts with no sanitization or authentication middleware. This vulnerability is fixed in 10.0.21.
Attack Vector
Network
Privileges Req.
None
User Interaction
None
oneuptime
Updated Oct 12, 2026View on NVD →
S4E scanner
CVE history: oneuptime
Predict next CVE date with AIMonitor this CVE on your assets
S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.
Create a free account →