CVE-2026-27728

OneUptime: OS Command Injection in Probe NetworkPathMonitor via unsanitized destination in traceroute exec()

Published Feb 25, 2026 CVSS 3.1 · 10 Critical EPSS 2.0% KEV · Not listed

Description

OneUptime is a solution for monitoring and managing online services. Prior to version 10.0.7, an OS command injection vulnerability in `NetworkPathMonitor.performTraceroute()` allows any authenticated project user to execute arbitrary operating system commands on the Probe server by injecting shell metacharacters into a monitor's destination field. Version 10.0.7 fixes the vulnerability.

Analysis

Technical impact

OneUptime exposes an OS command injection flaw within the NetworkPathMonitor.performTraceroute() method, allowing any authenticated project user to craft a destination value containing shell metacharacters that are unsafely forwarded to a traceroute system call. This flaw permits arbitrary execution of operating system commands on the Probe server, compromising confidentiality, integrity, and availability by giving attackers full control over that server. The weakness is a classic operating system command injection (CWE‑78).

Affected Systems

The vulnerability affects the OneUptime platform in all releases prior to version 10.0.7, any project that uses a Probe server, and any authenticated user with project‑level privileges who can configure a NetworkPathMonitor. No other vendors, products, or versions are mentioned as impacted.

Risk and Exploitability

The CVSS metric is 10.0, indicating maximum severity; the EPSS score is 2%, suggesting low exploitation probability, yet the flaw is not listed in the KEV catalog. Attackers require a valid user account on the project and can trigger the flaw by submitting a specially crafted traceroute destination. If the attack succeeds, the vulnerability allows execution of arbitrary system commands on the Probe server, which could affect confidentiality, integrity, and availability; the exact scope of impact is not stated in the advisory.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

OneUptime

oneuptime

affected

Version	Status	Constraints
`< 10.0.7`	affected	—

Configuration 1 [-]

cpe:2.3:a:hackerbay:oneuptime:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Oneuptime

Version	Status	Scheme	Platform
`[0,10.0.7)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to OneUptime 10.0.7 or a later patched release
Restrict project users’ rights so that only trusted personnel can configure NetworkPathMonitor and execute traceroute operations
Temporarily disable the NetworkPathMonitor’s traceroute capability until a patch is applied
Continuously monitor Probe server logs for anomalous command executions and enforce alerting

Generated by OpenCVE AI on June 18, 2026 at 10:42 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-jmhp-5558-qxh5	OneUptime: OS Command Injection in Probe NetworkPathMonitor via unsanitized destination in traceroute exec()

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: 2.0% (1.966% probability within 30 days)

Exploitation poc

Automatable yes

Technical Impact total

References

Link	Providers
https://github.com/OneUptime/oneuptime/commit/f2cce35a04fac756cecc7a4c55e23758b99288c1
https://github.com/OneUptime/oneuptime/security/advisories/GHSA-jmhp-5558-qxh5

History

Nov 10, 2026 9:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Mar 2, 2026 7:00 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Hackerbay Hackerbay oneuptime
CPEs		cpe:2.3:a:hackerbay:oneuptime::::::::
Vendors & Products		Hackerbay Hackerbay oneuptime

Feb 26, 2026 1:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Oneuptime Oneuptime oneuptime
Vendors & Products		Oneuptime Oneuptime oneuptime

Feb 25, 2026 5:15 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		OneUptime is a solution for monitoring and managing online services. Prior to version 10.0.7, an OS command injection vulnerability in `NetworkPathMonitor.performTraceroute()` allows any authenticated project user to execute arbitrary operating system commands on the Probe server by injecting shell metacharacters into a monitor's destination field. Version 10.0.7 fixes the vulnerability.
Title		OneUptime: OS Command Injection in Probe NetworkPathMonitor via unsanitized destination in traceroute exec()
Weaknesses		CWE-78
References		https://github.com/OneUptime/oneuptime/commit/f2cce35a04fac756cecc7a4c55e23758b99288c1 https://github.com/OneUptime/oneuptime/security/advisories/GHSA-jmhp-5558-qxh5
Metrics		cvssV3_1 `{'score': 10, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'}`