{"action":"Upgrade uptime-kuma to 1.22.1 or later.","affected":[{"fixed":"1.22.1","introduced":"0"}],"component":"uptime-kuma","cve_ids":["CVE-2023-36822"],"ecosystem":"npm","epss":0.01213,"exploited":false,"fixed_versions":["1.22.1"],"ghsa_id":"GHSA-vr8x-74pm-6vj7","id":"tcs_01M5KGCTVT81TFKEFEEGJH85K1","modified_at":"2026-09-10T03:50:14.423015241Z","published_at":"2024-05-01T10:01:02Z","references":["https://osv.dev/vulnerability/GHSA-vr8x-74pm-6vj7","https://github.com/louislam/uptime-kuma/security/advisories/GHSA-vr8x-74pm-6vj7","https://nvd.nist.gov/vuln/detail/CVE-2023-36822","https://github.com/louislam/uptime-kuma/pull/3346","https://github.com/louislam/uptime-kuma/commit/a0736e04b2838aae198c2110db244eab6f87757b","https://github.com/louislam/uptime-kuma","https://github.com/louislam/uptime-kuma/blob/de74efb2e6601dcbcfed32cddefc4078a80fcb0b/server/plugins-manager.js#L75-L80","https://github.com/louislam/uptime-kuma/releases/tag/1.22.1"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-vr8x-74pm-6vj7","url":"https://osv.dev/vulnerability/GHSA-vr8x-74pm-6vj7"}],"summary":"Uptime Kuma's authenticated path traversal via plugin repository name may lead to unavailability or data loss"}