# CVE-2024-56331: louislam Uptime Kuma LFI in Real-Browser monitor

Source: https://junglewise.ai/threats/cve-2024-56331-louislam-uptime-kuma-lfi-in-real-browser-monitor  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-12-20. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2024-56331 · Severity: low · CVSS 3.1 · Published 2024-12-20

Uptime Kuma is an open-source tool used to monitor the availability of websites and services. A security flaw in its 'Real-Browser' monitoring feature allows an authorized user to trick the system into taking screenshots of sensitive files stored on the server, such as password files or the application's own database. This could lead to the exposure of administrative credentials and other private system information.

## Quick answers

**Is CVE-2024-56331 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-56331 being exploited in the wild.

**How severe is CVE-2024-56331?** Low severity, with a CVSS score of 3.1, published 20 December 2024.

**Which products and versions are affected?** louislam uptime-kuma 1.23.0 - 1.23.15, 2.0.0-beta.0.

**Is there a fix for CVE-2024-56331?** A patch was published on 2024-12-20. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-56331 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2024-56331?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Local File Inclusion (LFI) vulnerability exists in Uptime Kuma's 'Real-Browser' monitor type due to insufficient server-side validation of user-provided URLs. While the frontend uses a regex pattern to suggest HTTP(S) protocols, the backend fails to enforce these restrictions, allowing the use of the 'file://' or 'view-source:file://' protocols. An authenticated attacker can create a monitor pointing to sensitive local paths (e.g., /etc/passwd or the Kuma database). The application then uses a headless browser to navigate to these paths and saves a screenshot of the file content, which can be retrieved by the attacker. This issue is fixed in versions 1.23.16 and 2.0.0-beta.1.

## Affected products

- louislam uptime-kuma 1.23.0 - 1.23.15, 2.0.0-beta.0

## Identifiers

- CVE-2024-56331
- GHSA-2qgm-m29m-cj2h

## Timeline

- 2024-12-20: disclosed
- 2024-12-20: advisory
- 2024-12-20: patched

## References

- [https://github.com/louislam/uptime-kuma/security/advisories/GHSA-2qgm-m29m-cj2h](https://github.com/louislam/uptime-kuma/security/advisories/GHSA-2qgm-m29m-cj2h)
- [https://github.com/louislam/uptime-kuma/commit/6cfae01a0d3727c517afe512fc8fec1d99acf875](https://github.com/louislam/uptime-kuma/commit/6cfae01a0d3727c517afe512fc8fec1d99acf875)
- [https://github.com/louislam/uptime-kuma](https://github.com/louislam/uptime-kuma)
- [https://github.com/louislam/uptime-kuma/releases/tag/1.23.16](https://github.com/louislam/uptime-kuma/releases/tag/1.23.16)