CVE-2026-27728

CVE-2026-27728 is an OS command injection vulnerability (CWE-78) in OneUptime, an open-source solution for monitoring and managing online services. The flaw affects versions prior to 10.0.7 and exists in the `NetworkPathMonitor.performTraceroute()` function, where insufficient input validation allows shell metacharacters injected into a monitor's destination field to execute arbitrary operating system commands on the Probe server. Published on 2026-02-25, it carries a CVSS v3.1 base score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), indicating critical severity due to its network accessibility, low attack complexity, and potential for high-impact privilege escalation across scope.

Any authenticated project user can exploit this vulnerability remotely without user interaction by crafting a malicious destination field in a monitor configuration. Exploitation grants arbitrary command execution on the Probe server, enabling full system compromise, data exfiltration, persistence, or further lateral movement, with severe consequences for confidentiality, integrity, and availability in environments relying on OneUptime for service monitoring.

OneUptime version 10.0.7 addresses the vulnerability through input sanitization or validation fixes. Security practitioners should upgrade immediately and review the GitHub security advisory at https://github.com/OneUptime/oneuptime/security/advisories/GHSA-jmhp-5558-qxh5 and the patching commit at https://github.com/OneUptime/oneuptime/commit/f2cce35a04fac756cecc7a4c55e23758b99288c1 for implementation details.