OneUptime Command Injection Vulnerability Poses Major Risk of Full System Takeover

A critical command-injection vulnerability (CVE-2026-27728) in OneUptime’s Probe Server allows authenticated project users to inject shell metacharacters into the traceroute destination field, leading to remote code execution and potential full system compromise; OneUptime patched the issue in version 10.0.7 by replacing exec() with execFile(), and the report urges immediate patching, configuration audits, monitoring, and interim isolation/workarounds.