CVE-2026-33130: Uptime Kuma Path Traversal Vulnerability

CVE-2026-33130 Overview

CVE-2026-33130 is a Server-Side Template Injection (SSTI) vulnerability affecting Uptime Kuma, an open source, self-hosted monitoring tool. This vulnerability represents an incomplete fix for a previous security advisory (GHSA-vffh-c9pq-4crh), where the mitigations added to the Liquid template engine fail to adequately prevent arbitrary file read attacks when using unquoted absolute paths.

The vulnerability exists in versions 1.23.0 through 2.2.0 of Uptime Kuma. The original security fix applied constraints to the LiquidJS file resolution process through root, relativeReference, and dynamicPartials options. However, these mitigations only block quoted paths. The require.resolve() fallback mechanism in liquid.node.js lacks any containment check, allowing attackers with authenticated access to read arbitrary files from the server using unquoted absolute paths.

Critical Impact

Authenticated attackers can read sensitive files on the server, including configuration files, credentials, and other sensitive data by exploiting the incomplete SSTI fix through unquoted absolute path injection.

Affected Products

• Uptime Kuma versions 1.23.0 through 2.2.0
• Self-hosted Uptime Kuma monitoring instances with notification providers enabled

Discovery Timeline

• 2026-03-20 - CVE-2026-33130 published to NVD
• 2026-03-24 - Last updated in NVD database

Technical Details for CVE-2026-33130

Vulnerability Analysis

This vulnerability stems from an incomplete security patch that was intended to prevent Server-Side Template Injection attacks in the Uptime Kuma notification system. The LiquidJS template engine is used to process notification templates, and the original fix attempted to restrict file access through three configuration options: root, relativeReference, and dynamicPartials.

The critical oversight lies in the third step of LiquidJS's file resolution process. While the first two steps are properly constrained, the require.resolve() fallback in liquid.node.js operates without any containment checks. This allows unquoted absolute paths like /etc/passwd to successfully resolve and be read by the template engine.

Interestingly, quoted paths are blocked only as a side effect: the literal quote characters cause require.resolve('"/etc/passwd"') to throw a MODULE_NOT_FOUND error rather than due to any intentional security measure. This accidental blocking mechanism does not extend to unquoted paths.

Root Cause

The root cause is an incomplete security fix in the notification-provider.js file. The fix only constrains the first two steps of LiquidJS's file resolution process through the root, relativeReference, and dynamicPartials options. The require.resolve() fallback mechanism in liquid.node.js was not addressed, leaving a path traversal vector that bypasses the intended security controls when unquoted absolute paths are supplied.

Attack Vector

The attack is network-based and requires low-privilege authenticated access to the Uptime Kuma application. An attacker with valid credentials can craft malicious notification templates containing unquoted absolute file paths. When these templates are processed by the LiquidJS engine, the require.resolve() fallback resolves the path without security validation, allowing the attacker to read arbitrary files from the server filesystem.

The attack does not require user interaction and exploits the notification provider functionality to exfiltrate sensitive data such as /etc/passwd, configuration files, application secrets, or database credentials stored on the server.

Detection Methods for CVE-2026-33130

Indicators of Compromise

• Unusual notification template configurations containing absolute file paths (e.g., /etc/passwd, /etc/shadow)
• Unexpected file access patterns from the Uptime Kuma application process
• Template rendering errors or anomalies in notification logs
• Attempts to access sensitive system files from the web application context

Detection Strategies

• Monitor notification template configurations for suspicious path patterns, particularly unquoted absolute paths
• Implement file integrity monitoring on sensitive system files to detect unauthorized read access
• Review Uptime Kuma application logs for template rendering errors or unusual file resolution attempts
• Deploy web application firewall rules to detect path traversal patterns in request payloads

Monitoring Recommendations

• Enable detailed logging for the notification provider subsystem in Uptime Kuma
• Configure security monitoring to alert on access to sensitive files from application processes
• Implement audit logging for notification template modifications and creations
• Set up real-time alerting for file system access anomalies from the Uptime Kuma service account

How to Mitigate CVE-2026-33130

Immediate Actions Required

• Upgrade Uptime Kuma to version 2.2.1 or later immediately
• Audit existing notification templates for suspicious content or path references
• Review user accounts with notification configuration privileges and restrict access as needed
• Temporarily disable custom notification templates if immediate patching is not possible

Patch Information

The vulnerability has been fixed in Uptime Kuma version 2.2.1. Organizations should update their installations as soon as possible. The fix addresses the incomplete mitigation by properly constraining the require.resolve() fallback mechanism.

For detailed patch information and release notes, refer to the GitHub Release Notes for version 2.2.1. Additional security context is available in the GitHub Security Advisory GHSA-v832-4r73-wx5j.

Workarounds

• Restrict notification template creation and modification privileges to trusted administrators only
• Implement network segmentation to limit the impact of potential file disclosure
• Deploy a reverse proxy with request filtering to detect and block path traversal attempts
• Consider running Uptime Kuma in a containerized environment with minimal filesystem access to limit exposure

# Upgrade Uptime Kuma to patched version
cd /path/to/uptime-kuma
git fetch --tags
git checkout 2.2.1
npm install --production
npm run setup
pm2 restart uptime-kuma