JavaScript Injection Vulnerability in Uptime Kuma's Matomo Analytics Integration
CVE-2026-71285

8.1HIGH

Key Information:

Vendor

Louislam

Status
Uptime-kuma
Vendor
CVE Published:
5 August 2026

What is CVE-2026-71285?

Uptime Kuma's Matomo analytics integration exposes a severe vulnerability due to improper escaping of JavaScript expressions within public status pages. The admin-configured Matomo siteId is injected directly into a script tag, allowing crafted values to execute arbitrary JavaScript code. If an administrator enters a malicious siteId, it can result in session-cookie theft and potentially compromise the entire page for unauthorized visitors. This vulnerability highlights the importance of stringent input validation and output encoding to prevent unauthorized code execution.

Affected Version(s)

uptime-kuma 0 <= 2.4.0

References

https://github.com/louislam/uptime-kuma
https://github.com/louislam/uptime-kuma/blob/master/serve...

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Alibek Baxtiyorov
.