GHSA-2qgm-m29m-cj2h: uptime-kuma vulnerable to Local File Inclusion (LFI) via Improper URL Handling in `Real-Browser` monitor
An Improper URL Handling Vulnerability allows an attacker to access sensitive local files on the server by exploiting the file:///
protocol. This vulnerability is triggered via the “real-browser” request type, which takes a screenshot of the URL provided by the attacker. By supplying local file paths, such as file:///etc/passwd
, an attacker can read sensitive data from the server.
References
Detect and mitigate GHSA-2qgm-m29m-cj2h with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →