Technical impact
Uptime Kuma’s Matomo analytics integration renders a <script> block on every public status page that contains the administrator‑configurable siteId value as a raw, unquoted JavaScript expression. An attacker who can edit the siteId can insert arbitrary code, such as a comma‑separated payload that closes the current statement and injects a new command. When the malicious value is saved, the unescaped script is executed in every browser that views the public /status/<slug> page, allowing the attacker to steal session cookies or perform any JavaScript action on the page. This stored XSS flaw (CWE‑79) provides full page takeover for unauthenticated visitors.
Affected Systems
The flaw appears in all installations of Uptime Kuma that have the Matomo analytics feature enabled; the vulnerability is not limited to a specific version number based on the information provided. Any user with administrative privileges who can change the siteId setting is able to inject the malicious payload. Non‑admin users and the public are only the victims of the injection.
Risk and Exploitability
With a CVSS score of 8.1 the vulnerability is high‑severity. The EPSS score of <1% indicates a low likelihood of exploitation, and the vulnerability is not listed in CISA KEV. The attack requires an authenticated admin to insert a crafted siteId value; once set, every unauthenticated visitor to the public /status/<slug> page will be exposed to the injected script. The consequence is session‑cookie theft and the potential for full page takeover, which can impact confidentiality, integrity, and availability of the public status page.
