CVE-2026-71285 louislam CVE debrief

Who should care

Administrators and users of Uptime Kuma, particularly those who have configured the Matomo analytics integration, should be aware of this vulnerability and take steps to mitigate it. This includes reviewing and updating the Matomo siteId configuration to prevent potential JavaScript injection attacks, monitoring for suspicious activity on public status pages, and considering additional security measures to prevent session-cookie theft and page takeover. Vulnerability management and security teams should also be aware of this vulnerability and track exceptions, retest remediated assets, and close the item only after evidence is documented.

Technical summary

Uptime Kuma's Matomo analytics integration is vulnerable to JavaScript injection due to insufficient escaping of the siteId value. This allows an attacker to inject arbitrary JavaScript code, potentially leading to session-cookie theft and full page takeover. The vulnerability exists in the server/analytics/matomo-analytics.js file, where the admin-configurable Matomo siteId value is injected as a bare, unquoted JavaScript expression inside a <script> block rendered on every public status page. To prevent potential JavaScript injection attacks, administrators and users of Uptime Kuma should prioritize reviewing and updating the Matomo siteId configuration.

Defensive priority

Administrators and users of Uptime Kuma should prioritize reviewing and updating the Matomo siteId configuration to prevent potential JavaScript injection attacks.

Recommended defensive actions

• Review and update the Matomo siteId configuration to prevent potential JavaScript injection attacks
• Monitor for suspicious activity on public status pages
• Consider implementing additional security measures to prevent session-cookie theft and page takeover
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE description indicates that Uptime Kuma's Matomo analytics integration is vulnerable to JavaScript injection due to insufficient escaping of the siteId value. This allows an attacker to inject arbitrary JavaScript code, potentially leading to session-cookie theft and full page takeover. The vulnerability exists in the server/analytics/matomo-analytics.js file, where the admin-configurable Matomo siteId value is injected as a bare, unquoted JavaScript expression inside a <script> block rendered on every public status page. To verify and mitigate this vulnerability, defenders should review the Matomo siteId configuration, monitor for suspicious activity on public status pages, and consider implementing additional security measures to prevent session-cookie theft and page takeover.

Official resources