cbcvebase.
CVE-2026-30958
published 2026-03-10

CVE-2026-30958: OneUptime is a solution for monitoring and managing online services. Prior to 10.0.21, an unauthenticated path traversal in the /workflow/docs/:componentName…

PriorityP268high8.6CVSS 3.1
AVNACLPRNUINSCCHINAN
EXPLOIT
EPSS
1.14%
64.0th percentile
OneUptime is a solution for monitoring and managing online services. Prior to 10.0.21, an unauthenticated path traversal in the /workflow/docs/:componentName endpoint allows reading arbitrary files from the server filesystem. The componentName route parameter is concatenated directly into a file path passed to res.sendFile() in orker/FeatureSet/Workflow/Index.ts with no sanitization or authentication middleware. This vulnerability is fixed in 10.0.21.

Affected

2 ranges
VendorProductVersion rangeFixed in
hackerbayoneuptime< 10.0.2110.0.21
oneuptimeoneuptime< 10.0.2110.0.21

Detection & IOCsextracted from sources · hover to see the quote

url/workflow/docs/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd↗
path/workflow/docs/:componentName↗
  • →Look for GET requests to /workflow/docs/ containing URL-encoded path traversal sequences (e.g., %2f..%2f or ../) targeting sensitive files such as /etc/passwd. No authentication is required, so these requests will arrive unauthenticated. ↗
  • →Flag HTTP 200 responses to /workflow/docs/ requests where the response body matches the pattern 'root:.*:0:0:' (indicative of /etc/passwd content being returned). ↗
  • →Use the FOFA query 'title="OneUptime"' to identify exposed OneUptime instances for proactive scanning and patching. ↗
  • →The vulnerable code path is in Worker/FeatureSet/Workflow/Index.ts — monitor file access logs or application logs for unexpected file reads triggered via this endpoint. ↗
  • ·No authentication middleware is present on the vulnerable endpoint, meaning exploitation requires zero credentials and is remotely exploitable over the network. ↗
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.