CVE-2026-71285 Overview
CVE-2026-71285 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in Uptime Kuma's Matomo analytics integration. The flaw resides in server/analytics/matomo-analytics.js, where the admin-configurable Matomo siteId value is injected as an unquoted JavaScript expression inside a <script> block. The block is rendered on every public status page. An administrator or editor who saves a malicious siteId value causes arbitrary JavaScript to execute for every unauthenticated visitor of the /status/<slug> page. Successful exploitation enables session-cookie theft and full page takeover.
Critical Impact
A malicious siteId value executes attacker-controlled JavaScript in every visitor's browser, enabling cookie theft, session hijacking, and complete takeover of public status pages.
Affected Products
- Uptime Kuma (open-source status/monitoring application)
- Deployments using the Matomo analytics integration (server/analytics/matomo-analytics.js)
- Public status pages served at /status/<slug>
Discovery Timeline
- 2026-08-05 - CVE-2026-71285 published to the National Vulnerability Database (NVD)
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-71285
Vulnerability Analysis
Uptime Kuma renders Matomo tracking code directly into the HTML of public status pages. The generated script contains the expression _paq.push(['setSiteId', ${escapedSiteIdHTMLAttribute}]);, where escapedSiteIdHTMLAttribute is the admin-supplied siteId. The value is inserted as a raw JavaScript expression rather than a quoted string literal.
The escaping pipeline first passes the value through jsesc with isScriptContext: true, then through html-escaper.escape(). Neither stage escapes the characters ], ), ;, or (. Those four characters are sufficient to close the array literal, terminate the push() call, end the statement, and inject arbitrary JavaScript that runs in the origin of the status page.
Because status pages are unauthenticated and publicly reachable, every visitor executes the injected payload. The attacker can steal session cookies, pivot to authenticated Uptime Kuma sessions, or deface the page.
Root Cause
The root cause is unsafe interpolation of user-controlled input into a script context. The developers relied on jsesc and html-escaper for sanitization, but neither escapes the delimiters that structure the surrounding JavaScript expression. The siteId field also lacks server-side input validation restricting it to numeric values, which is Matomo's documented format.
Attack Vector
Exploitation requires high privileges: an attacker must already possess editor or administrator credentials to modify the Matomo siteId setting. User interaction is required in the form of a visitor loading the affected public status page. Once the malicious siteId value is stored, exploitation is persistent and affects every subsequent visitor until an administrator corrects the configuration.
A payload such as 1]);alert(document.cookie)// closes the push() call, executes attacker JavaScript, and comments out the trailing syntax to keep the script parseable. Real-world payloads would exfiltrate cookies or session tokens to attacker-controlled infrastructure. Refer to the Uptime Kuma analytics source for the exact rendering path.
Detection Methods for CVE-2026-71285
Indicators of Compromise
- Non-numeric values stored in the Matomo siteId configuration field, especially strings containing ], ), ;, or //.
- Unexpected outbound requests from visitor browsers to unknown domains originating from /status/<slug> pages.
- Rendered HTML of public status pages containing JavaScript beyond the standard _paq.push calls.
Detection Strategies
- Fetch each public status page and inspect the inline <script> block for tokens outside the expected numeric setSiteId pattern.
- Audit the Uptime Kuma database (settings table) for any Matomo configuration entries with non-integer siteId values.
- Review admin and editor account activity logs for recent modifications to analytics settings.
Monitoring Recommendations
- Alert on HTTP responses from /status/* endpoints containing suspicious JavaScript keywords such as document.cookie, fetch(, or eval(.
- Monitor administrative changes to analytics configuration and require change approval.
- Enable Content Security Policy (CSP) reporting to capture inline-script violations on status pages.
How to Mitigate CVE-2026-71285
Immediate Actions Required
- Audit the Matomo siteId value in every Uptime Kuma instance and reset it to a numeric value or clear it entirely.
- Restrict administrator and editor accounts to trusted personnel and rotate credentials suspected of compromise.
- Temporarily disable the Matomo analytics integration on public status pages until a patched release is deployed.
Patch Information
At time of publication, no fixed release version is referenced in the NVD entry. Track the Uptime Kuma repository and the Matomo analytics source file for the corrective commit. Any fix should enforce numeric-only validation on siteId and inject the value as a properly quoted JSON literal rather than a bare expression.
Workarounds
- Deploy a strict Content Security Policy that disallows inline event handlers and restricts script sources, reducing the impact of injected payloads.
- Place a reverse proxy in front of Uptime Kuma that rewrites or strips the Matomo <script> block on /status/* responses.
- Enforce numeric input validation for the siteId field via a database constraint or application-layer middleware until an official patch is available.
# Example: enforce numeric siteId in the Uptime Kuma SQLite settings table
sqlite3 kuma.db "UPDATE setting SET value='' WHERE key='matomoSiteId' AND value NOT GLOB '[0-9]*';"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
