CVE-2026-30958: Oneuptime Path Traversal Vulnerability

CVE-2026-30958 Overview

CVE-2026-30958 is a path traversal vulnerability in OneUptime, an open-source solution for monitoring and managing online services. Prior to version 10.0.21, the /workflow/docs/:componentName endpoint is vulnerable to unauthenticated path traversal attacks, allowing remote attackers to read arbitrary files from the server filesystem. This vulnerability poses significant risk as it can expose sensitive configuration files, credentials, and other confidential data stored on affected systems.

Critical Impact

Unauthenticated remote attackers can read arbitrary files from servers running vulnerable OneUptime instances, potentially exposing sensitive configuration data, API keys, and system credentials.

Affected Products

• Hackerbay OneUptime versions prior to 10.0.21
• All deployments exposing the /workflow/docs/ endpoint to untrusted networks
• Self-hosted OneUptime instances without additional access controls

Discovery Timeline

• 2026-03-10 - CVE-2026-30958 published to NVD
• 2026-03-12 - Last updated in NVD database

Technical Details for CVE-2026-30958

Vulnerability Analysis

This path traversal vulnerability (CWE-22) exists in the workflow documentation endpoint of OneUptime. The flaw allows unauthenticated attackers to traverse the filesystem and access files outside the intended directory structure. The vulnerability is particularly severe because it requires no authentication and can be exploited remotely over the network without user interaction. Successful exploitation allows attackers to read sensitive files such as /etc/passwd, application configuration files, environment variables, and potentially database credentials stored on the server.

Root Cause

The root cause of this vulnerability lies in the improper handling of the componentName route parameter in the file worker/FeatureSet/Workflow/Index.ts. The user-supplied componentName value is concatenated directly into a file path that is passed to the res.sendFile() function without any sanitization, validation, or path canonicalization. Additionally, the endpoint lacks authentication middleware, allowing any unauthenticated user to exploit this flaw. The absence of input validation enables attackers to use directory traversal sequences (such as ../) to escape the intended directory and access arbitrary files on the filesystem.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can craft malicious HTTP requests to the /workflow/docs/:componentName endpoint by manipulating the componentName parameter with directory traversal sequences. By including sequences like ../../../etc/passwd, an attacker can traverse up the directory structure and read sensitive system files. The vulnerability can be exploited using standard HTTP tools such as curl or a web browser, making exploitation trivial for attackers with network access to the affected endpoint.

The exploitation technique involves sending HTTP GET requests with path traversal payloads in the URL path. For example, requesting /workflow/docs/../../../../etc/passwd would cause the server to read and return the contents of the system password file. Attackers can systematically enumerate and exfiltrate sensitive files including application configuration, database credentials, and environment variables containing API keys.

Detection Methods for CVE-2026-30958

Indicators of Compromise

• HTTP requests to /workflow/docs/ containing path traversal sequences such as ../, ..%2f, or ..%252f
• Access logs showing requests for sensitive file paths like /etc/passwd, /etc/shadow, or application configuration files
• Unusual patterns of file access from the OneUptime worker process
• Network traffic anomalies showing exfiltration of configuration or credential data

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block path traversal patterns in URL paths
• Monitor HTTP access logs for requests containing encoded or unencoded directory traversal sequences
• Deploy intrusion detection system (IDS) signatures for path traversal attack patterns targeting the /workflow/docs/ endpoint
• Enable file integrity monitoring on sensitive system files to detect unauthorized read attempts

Monitoring Recommendations

• Configure centralized logging for all HTTP requests to OneUptime endpoints with full URL path capture
• Set up alerting for requests containing path traversal indicators such as ../, URL-encoded variants, and double-encoding attempts
• Monitor system file access patterns from the OneUptime application process for anomalous reads outside expected directories
• Implement network traffic analysis to detect potential data exfiltration following exploitation attempts

How to Mitigate CVE-2026-30958

Immediate Actions Required

• Upgrade OneUptime to version 10.0.21 or later immediately to remediate this vulnerability
• If immediate patching is not possible, restrict network access to the /workflow/docs/ endpoint using firewall rules or reverse proxy configurations
• Review server logs for any historical exploitation attempts targeting this endpoint
• Rotate any credentials or API keys that may have been exposed on affected systems

Patch Information

Hackerbay has released OneUptime version 10.0.21 which addresses this vulnerability. The fix implements proper input sanitization and path validation for the componentName parameter. Organizations should upgrade to this version or later as soon as possible. For detailed information about the fix, refer to the GitHub Release Notes and the GitHub Security Advisory.

Workarounds

• Block access to the /workflow/docs/ endpoint at the network perimeter using firewall rules or reverse proxy configurations
• Implement a web application firewall (WAF) rule to reject requests containing path traversal sequences in URL paths
• Add authentication requirements to the vulnerable endpoint through reverse proxy configuration if the application cannot be immediately patched
• Isolate OneUptime instances from sensitive network segments to limit the impact of potential file disclosure

# Example nginx configuration to block path traversal attempts
location /workflow/docs/ {
    # Block requests containing path traversal sequences
    if ($request_uri ~* "\.\.") {
        return 403;
    }
    # Alternatively, restrict access entirely until patched
    # deny all;
}