The vulnerability allows an attacker to exploit server‑side template injection (SSTI) within the notification template engine of Uptime Kuma. By supplying an unquoted absolute file path such as "/etc/passwd" to the template, the Liquid engine will resolve the path and return the file contents. This enables an attacker to read any file on the host where the vulnerable instance is running, exposing sensitive configuration, credentials, or system data. The weakness is present in the template resolution logic, specifically an unguarded fallback that bypasses containment checks.

Affected versions are Uptime Kuma 1.23.0 through 2.2.0, released by louislam. The issue existed in the core code that processes notification templates and persisted across multiple releases until the fix in 2.2.1.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of active exploitation. The vulnerability is not listed in the CISA KEV catalog. Attack requires the ability to inject into a notification template, so compromising the template configuration or templates stored locally. Although it does not provide remote code execution, the disclosure of arbitrary files can assist attackers in planning further attacks or surface credentials.