CVE-2026-33130 is a Server-side Template Injection (SSTI) vulnerability affecting Uptime Kuma versions 1.23.0 through 2.2.0, where an incomplete fix allows attackers to read arbitrary files on the server. This flaw has a Medium severity CVSS score of 6.5, indicating a high confidentiality impact with a network attack vector and low attack complexity, requiring only low privileges and no user interaction. An attacker can exploit this by using unquoted absolute paths to bypass existing mitigations. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this vulnerability. The issue has been resolved in Uptime Kuma version 2.2.1.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 1.23.0, < 2.2.1CPE matchmatch criteria | cpe:2.3:a:uptime.kuma:uptime_kuma:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.