CVE-2026-71285
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
Uptime Kuma's Matomo analytics integration injects the admin-configurable Matomo value as a bare, unquoted JavaScript expression inside a <script> block rendered on every public status page. A siteId value such as , once saved by an editor/admin, executes arbitrary JavaScript for every unauthenticated visitor of the public /status/<slug> page, enabling session-cookie theft and full page takeover.
Risk Assessment
An attacker with editor or admin privileges can execute malicious script in the browsers of all visitors to public status pages, potentially leading to session theft and account takeover.
Recommendation
Update Uptime Kuma to a version that properly validates and quotes Matomo values, and restrict editing permissions for integration settings to trusted administrators only.
Other vulnerabilities in Uptime Kuma
See all- CVE-2023-36822Medium
Uptime Kuma, a monitoring tool, has a path traversal vulnerability in versions prior to 1.22.1. This allows authenticated users to delete files from the server, potentially leading to data loss and system unavailability.
- CVE-2023-36821High
Uptime Kuma, a monitoring tool, allows an authenticated attacker to install a maliciously crafted plugin in versions prior to 1.22.1, which may lead to remote code execution. Although the plugin installation feature is currently disabled in the web interface, the corresponding API endpoints are still available after login.
Original NVD description (English source)
Uptime Kuma's Matomo analytics integration (server/analytics/matomo-analytics.js) injects the admin-configurable Matomo value as a bare, unquoted JavaScript expression inside a <script> block rendered on every public status page. A siteId value such as , once saved by an editor/admin, executes arbitrary JavaScript for every unauthenticated visitor of the public /status/<slug> page, enabling session-cookie theft and full page takeover.