Yüksek CVSS 8.6 PoC var
CVE-2026-30958: Oneuptime: dizin geçişi
Açıklama (NVD)
OneUptime is a solution for monitoring and managing online services. Prior to 10.0.21, an unauthenticated path traversal in the /workflow/docs/:componentName endpoint allows reading arbitrary files from the server filesystem. The componentName route parameter is concatenated directly into a file path passed to res.sendFile() in orker/FeatureSet/Workflow/Index.ts with no sanitization or authentication middleware. This vulnerability is fixed in 10.0.21.
Özet bilgiler
- Ürün
- Hackerbay Oneuptime
- CVSS v3.1
- 8.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N - EPSS
- %1,25 (yüzdelik 69)
- CWE
- CWE-22
- Yama
- Geçici çözüm
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| hackerbay-oneuptime | — | — | 10.0.21 |