CVE-2026-30958 OneUptime: Path Traversal — Arbitrary File Read (No Auth)

High 7.2 Published 10 Mar 2026 Updated 10 Mar 2026

Unauthenticated attackers can read arbitrary files from the server filesystem via a path traversal vulnerability in the workflow docs endpoint.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-30958?

CVE-2026-30958 is a high-severity path traversal vulnerability in oneuptime, published on 10 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.21, an unauthenticated path traversal in the /workflow/docs/:componentName endpoint allows reading arbitrary files from the server filesystem. The componentName route parameter is concatenated directly into a file path passed to res.sendFile() in orker/FeatureSet/Workflow/Index.ts with no sanitization or authentication middleware. This vulnerability is fixed in 10.0.21.

Weakness: CWE-22

Which versions are affected by CVE-2026-30958?

It affects 1 product.

Products include Hackerbay Oneuptime.

How do I fix CVE-2026-30958?

No fix has been published for CVE-2026-30958 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2026-30958 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-30958 exists.

Public exploit code: 1 Nuclei template.

Sources

Also known as GHSA-p2wh-9pw8-hvff.