Detections
Analytics
SCA: security update for uptime-kuma (GHSA-vr8x-74pm-6vj7)
high Tenable Cloud Security Plugin ID 433955
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Uptime Kuma, a self-hosted monitoring tool, has a path traversal vulnerability in versions prior to
1.22.1. Uptime Kuma allows authenticated users to install plugins from an official list of plugins. This
feature is currently disabled in the web interface, but the corresponding API endpoints are still
available after login. Before a plugin is downloaded, the plugin installation directory is checked for
existence. If it exists, it's removed before the plugin installation. Because the plugin is not validated
against the official list of plugins or sanitized, the check for existence and the removal of the plugin
installation directory are prone to path traversal. This vulnerability allows an authenticated attacker to
delete files from the server Uptime Kuma is running on. Depending on which files are deleted, Uptime Kuma
or the whole system may become unavailable due to data loss. (CVE-2023-36822)
See Also
Plugin Details
Severity: High
ID: 433955
Version: Revision 1.4
Type: Local
Family: SCA Checks
Published: 8/19/2025
Updated: 6/1/2026
Risk Information
VPR
Risk Factor: Medium
Score: 6.0
Vendor
Vendor Severity: Medium
CVSS v2
Risk Factor: High
Base Score: 8.5
Temporal Score: 6.7
Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:C/A:C
CVSS Score Source: CVE-2023-36822
CVSS v3
Risk Factor: High
Base Score: 8.1
Temporal Score: 7.3
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 5/1/2024
Vulnerability Publication Date: 7/5/2023
Reference Information
CVE: CVE-2023-36822
cwe: CWE-22