CVE-2026-71285

Name of the Vulnerable Software and Affected Versions Uptime Kuma (affected versions not specified)

Description The Matomo analytics integration in the server/analytics/matomo-analytics.js file allows the injection of the admin-configurable siteId value as an unquoted JavaScript expression within a <script> block on public status pages. The escaping process fails to filter characters such as ], ), ;, and (, allowing an attacker with editor or admin privileges to break out of the paq.push() function context. This can lead to the execution of arbitrary JavaScript for any unauthenticated visitor accessing the /status/<slug> endpoint, potentially resulting in session-cookie theft and full page takeover.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict the use of the siteId parameter in the Matomo analytics configuration to prevent the injection of malicious scripts.