HIGH

CVE-2026-71285

2026-08-05 CVSS v3.1

CVSS

8.1

Description

Uptime Kuma's Matomo analytics integration (server/analytics/matomo-analytics.js) injects the admin-configurable Matomo value as a bare, unquoted JavaScript expression inside a <script> block rendered on every public status page. A siteId value such as , once saved by an editor/admin, executes arbitrary JavaScript for every unauthenticated visitor of the public /status/<slug> page, enabling session-cookie theft and full page takeover.

Weakness (CWE)

CWE-79 Cross-site Scripting (XSS)

EPSS Score

0.23%

Probability of exploitation in next 30 days

13.8th percentile

References

https://github.com/louislam/uptime-kuma https://github.com/louislam/uptime-kuma/blob/master/server/analytics/matomo-analytics.js

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE