CVE-2026-71285 Details
Description
Uptime Kuma's Matomo analytics integration (server/analytics/matomo-analytics.js) injects the admin-configurable Matomo value as a bare, unquoted JavaScript expression inside a <script> block rendered on every public status page. A siteId value such as , once saved by an editor/admin, executes arbitrary JavaScript for every unauthenticated visitor of the public /status/<slug> page, enabling session-cookie theft and full page takeover.
A cross-site scripting vulnerability has been identified in Uptime Kuma's Matomo analytics integration, specifically in the 'matomo-analytics.js' file. The issue arises because the 'siteId' value, which is configurable by the admin, is injected as an unquoted JavaScript expression into a script block that is rendered on every public status page. The current escaping method used does not properly sanitize certain characters, allowing an attacker to manipulate the 'siteId' value and execute arbitrary JavaScript. This injected script could steal session cookies and take over the user's page.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 5, 2026CISA-ADP
Assessed Aug 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/louislam/uptime-kuma | TuranSec | Vendor |
| https://github.com/louislam/uptime-kuma/blob/master/server/analytics/matomo-analytics.js | TuranSec | Source CodeVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | TuranSec |
Affected Products
| Product | Versions |
|---|---|
| Uptime Kuma | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 10, 2026 | CVE Modified | TuranSec |
| Aug 5, 2026 | CVE Modified | CISA-ADP |
| Aug 5, 2026 | New CVE Received | TuranSec |