Threats affecting pkg:github/louislam/uptime-kuma

Uptime Kuma versions through 2.5.8 have a race condition vulnerability in the Socket.IO first-run setup handler. This flaw allows unauthenticated attackers to create an additional administrator account by sending concurrent setup requests during the bcrypt hashing process. Exploitation enables attackers to bypass the empty user table check and subsequently modify monitors, API keys, and toggle authentication settings.

CVE-2026-33130 is a medium-severity vulnerability in Uptime Kuma versions 1.23.0 through 2.2.0 that allows attackers with limited privileges to read arbitrary files on the server. The issue arises from improper control of filename inclusion in the LiquidJS template engine, specifically in the require.resolve() fallback mechanism, which lacks containment checks for unquoted absolute paths. This flaw enables remote file inclusion (RFI) attacks, potentially exposing sensitive server files such as /etc/passwd. The vulnerability does not require user interaction but does require some level of privileges (PR:L). It was fixed in version 2.

CVE-2026-32230 is a medium severity vulnerability in Uptime Kuma versions 2.0.0 through 2.1.3 where the GET /api/badge/:id/ping/:duration? endpoint fails to verify authorization properly. This flaw allows unauthenticated users to access average ping/response time data for private monitors, bypassing the intended access control that restricts such data to public monitors only. The vulnerability arises from missing authorization checks on this specific endpoint, while other badge endpoints correctly enforce public group verification. Exploitation requires no authentication or user interaction and can lead to unauthorized disclosure of monitoring data. The issue is fixed in version 2.

Uptime Kuma >== 1.23.0 has a ReDoS vulnerability, specifically when an administrator creates a notification through the web service. If a string is provided it triggers catastrophic backtracking in the regular expression, leading to a ReDoS attack.