uptime-kuma
2.5.11A fancy self-hosted monitoring tool
- Maintenance
- Active195 commits in 3 months · bus factor 1
- License
- MITPermissive · OSI-approved
- Security
- 22 advisories4 high, 16 medium, 2 low
- Supported versions
- No scheduleendoflife.date does not track this project
94.4k stars · 8.8k forks · 855 open issues · last release 3 days ago · data checked 4 hours ago
Security advisories
All advisories on GitHubThe 22 most recent advisories published by the maintainers: 4 high, 16 medium, 2 low. Check the patched version against the one you run.
- highGHSA-v2p3-6f5h-6hhfNov 2, 2026Authenticated RCE via Apprise CLI Argument Injection (Missing -- Separator)
- Affected
- >= 1.0.6, <= 2.5.7
- Patched in
- 2.5.8
- mediumGHSA-86ch-2247-gr56Oct 31, 2026Unauthenticated Host-header injection and RSS cache poisoning
- Affected
- >= 2.1.0, <= 2.5.8
- Patched in
- 2.5.9
- mediumGHSA-98hr-q8q8-5j23Oct 27, 2026Rootless privilege escalation
- Affected
- >= 2.0.0, <= 2.5.5
- Patched in
- 2.5.6
- highGHSA-wf2j-5mc7-5c4wOct 9, 2026Unauthenticated resource exhaustion DoS in ping badge endpoint via arbitrary monitor IDs
- Affected
- <=2.5.3
- Patched in
- 2.5.4
- mediumCVE-2026-33130Mar 16, 2026Another Server-side Template Injection (SSTI) in Notification Templates Allows Arbitrary File Read
- Affected
- >= 1.23.0
- Patched in
- 2.2.1
- mediumCVE-2026-32230Mar 11, 2026Missing Authorization Check on Ping Badge Endpoint Leaks Ping times of montors without needing to be on a status page
- Affected
- >= 2.0.0 && <= 2.1.3
- Patched in
- 2.2.0
- lowGHSA-9fg7-wgm7-57fhFeb 8, 2026RSS status feed does not set content type, leading to a Stored XSS in Public Status Page RSS Feed via CDATA escaped Monitor Name IF USING AN UNSECURE CLIENT
- Affected
- >= 2.0.0 && <= 2.0.2
- Patched in
- 2.1.0
- mediumGHSA-vffh-c9pq-4crhOct 20, 2025Server-side Template Injection (SSTI) in Notification Templates Allows Arbitrary File Read
- Affected
- >= 1.23.0 && <= 1.23.16; <= 2.0.0-beta.4
- Patched in
- 1.23.17; 2.0.0
- mediumGHSA-qjxc-h5jf-c7rjOct 13, 2025GCP and selected cloud providers provide metadata endpoints to the local network which can be queried to extract sensitive information via authentificated accounts in uptime kuma
- Affected
- *
- highGHSA-5px6-fx2w-459rJun 4, 2025Unauthenticated file read of files that begin with `index.`
- Affected
- >= 2.0.0-beta.0, <= 2.0.0-beta.2
- Patched in
- 2.0.0-beta.3
- mediumGHSA-hx7h-9vf7-5xhgMar 29, 2025Regular Expression in pushdeeer and whapi file Leads to ReDoS Vulnerability Due to Catastrophic Backtracking
- Affected
- >= 1.15.0 && <= 1.23.16; 2.0.0-beta.0, 2.0.0-beta.1
- Patched in
- 2.0.0-beta.2
- mediumCVE-2024-56331Dec 20, 2024Local File Inclusion (LFI) via Improper URL Handling in `Real-Browser` monitor
- Affected
- 1.23.0 - 1.23.15; 2.0.0-beta.0
- Patched in
- 1.23.16; 2.0.0-beta.1
- lowGHSA-23q2-5gf8-gjppApr 19, 2024Enabling Authentication does not close all logged in socket connections immediately
- Affected
- <=1.23.11
- Patched in
- 1.23.12
- mediumCVE-2023-49804Dec 10, 2023Changing Password does not close all logged in socket connections immediately
- Affected
- <= 1.23.8; <= 1.3.2
- Patched in
- 1.23.9; 1.3.3
- mediumCVE-2023-49805Dec 10, 2023Missing Origin Validation in WebSockets
- Affected
- <= 1.3.2; <= 1.23.8
- Patched in
- 1.3.3; 1.23.9
- mediumGHSA-hfxh-rjv7-2369Nov 24, 2023Authenticated remote code execution via TailscalePing
- Affected
- >= 1.23.0 && <= 1.23.6
- Patched in
- 1.23.7
- mediumCVE-2023-49276Nov 24, 2023Attribute Injection leading to XSS(Cross-Site-Scripting)
- Affected
- >= 1.20.0 && <= 1.23.6
- Patched in
- 1.23.7
- mediumCVE-2023-44400Oct 9, 2023Persistentent User Sessions
- Affected
- <= v1.23.2
- Patched in
- v1.23.3
- mediumCVE-2023-36822Jul 4, 2023Authenticated path traversal via plugin repository name leading to unavailability or data loss
- Affected
- <= 1.22.0
- Patched in
- 1.22.1
- highCVE-2023-36821Jul 4, 2023Authenticated remote code execution via malicious plugin installation
- Affected
- <= 1.22.0
- Patched in
- 1.22.1
- mediumCVE-2023-25811Feb 13, 2023Persistent XSS through "new status page --> name"
- Affected
- <= 1.19.6
- Patched in
- 1.20.0
- mediumCVE-2023-25810Feb 13, 2023Persistent XSS through description in status page
- Affected
- <= 1.19.6
- Patched in
- 1.20.0