How to use this reference
Editorial lesson: define a minimal capability set for user-editable templates and keep notification formatting separate from host-file authority. Apply containment consistently across every resolution path, including fallbacks; process-level least privilege limits exposure but does not repair template isolation. Review later maintainer advisories before treating an earlier patch as complete. The 2.2.1 release credits upstream LiquidJS remediation. Capability removal is suggested in the follow-up advisory, but this review does not establish that suggestion as the shipped implementation.
Before reading
- Server-side template evaluation and capability boundaries
- Application-process file permissions and remediation evidence
Context and limits
- Applicability requires an authenticated user able to edit notification templates in an affected configuration. File disclosure is bounded by application-process read permissions; operating-system execution and production compromise are not established by these sources.
- The original advisory lists >=1.23.0 through 1.23.16 and <=2.0.0-beta.4 as affected, with 1.23.17 and 2.0.0 initially marked patched. The October 20, 2025 release of 2.0.0 references that advisory; these historical patch claims are qualified by the later incomplete-fix evidence.
- GHSA-v832-4r73-wx5j, published March 16, 2026, reports continued file disclosure on 2.1.3 and lists 2.2.1 as patched. Its affected field says >=1.23.0 without an upper bound. The March 10, 2026 release of 2.2.1 attributes the correction to upstream LiquidJS. These are software and follow-up disclosure events, not this resource's original publication or edition date.
- louislam published the original advisory; TriangleSnake is credited as Reporter. No separate author byline was established, so authors remains empty. The follow-up separately credits peaktwilight as Reporter.
- The original advisory states no known CVE. CVE-2026-33130 belongs to the follow-up advisory and is not assigned to the 2025 finding here. The follow-up supplies remediation context for this single educational record, not a second 2026 case.
- Historical fixed-version labels are source claims, not a current safety recommendation or independent proof of patch effectiveness. No qualifying individual award is established. Learning prerequisites and generalized defensive guidance are editorial.
Sources and provenance
- Server-side Template Injection (SSTI) in Notification Templates Allows Arbitrary File Read Uptime Kuma maintainers · reviewed 2026-10-05
- Uptime Kuma 2.0.0 release Uptime Kuma maintainers · reviewed 2026-10-05
- Another Server-side Template Injection (SSTI) in Notification Templates Allows Arbitrary File Read Uptime Kuma maintainers · reviewed 2026-10-05
- Uptime Kuma 2.2.1 release Uptime Kuma maintainers · reviewed 2026-10-05
Record reviewed 2026-10-05. Snapshot cb017eaea66e. Open the complete JSON contract.