This vulnerability is a path traversal flaw in the /workflow/docs/:componentName endpoint of OneUptime. An attacker can supply a specially crafted componentName value that, after concatenation into a file system path, bypasses the intended directory boundaries. The flaw allows reading any file accessible by the running process, including configuration files, secrets, and potentially sensitive data. Because no authentication checks are performed, any network user can exploit the flaw without credentials, leading to a high risk of data exposure.

Affected are installations of OneUptime version prior to 10.0.21, with a componentName route that feeds directly into res.sendFile(). The vulnerability applies to all vendors or products named OneUptime:oneuptime, encompassing any deployment of the open‑source monitoring platform.

The CVSS score of 7.2 indicates a high severity, and although the EPSS score is below 1 %, the absence of a KEV listing does not diminish the potential impact. The lack of authentication makes the attack vector trivial for an external actor with network access to the endpoint. The exploit requires only a HTTP request, no special privileges, and can be performed by modifying the path segments or using relative directory references. Once triggered, the attacker obtains arbitrary filesystem content.