CVE-2026-71285 is a stored XSS in Uptime Kuma's Matomo integration where the siteId configuration value—set by an instance admin—is rendered into public status pages without proper script-context escaping. The vulnerability lives in how Uptime Kuma renders the Matomo tracking snippet: it passes the configured siteId through jsesc with isScriptContext:true, then through html-escaper.escape(), but the composition fails to escape closing brackets, parentheses, and semicolons. A payload like test");alert(document.cookie)// bypasses the escaping and breaks out of the string literal to execute arbitrary JavaScript in every visitor's browser who views that organization's status page.
What makes this severe is the cross-tenant blast radius. Uptime Kuma's public status pages are shared infrastructure—visitors don't authenticate, and they may belong to organizations entirely unrelated to the admin who configured the Matomo siteId. Compromising one admin account lets you inject JavaScript that executes in the browsers of visitors monitoring completely different organizations. The attacker-victim relationship has no correspondence to the admin-instance relationship. This isn't a self-contained XSS in an admin panel; it's cross-tenant code execution through shared public infrastructure.
The root cause is a trust-model inconsistency: the codebase assumed 'admin-controlled' equals 'trusted,' but admin configuration renders into a context—the visitor's browser—that the admin has no legitimate authority over. The escaping pipeline failure (jsesc's isScriptContext flag not delivering its advertised safety) is a technical symptom of this architectural misclassification.
Check your deployed Uptime Kuma versions against the advisory. If you're self-hosting multi-tenant instances, treat all admin-sourced configuration values as untrusted when they render into shared public contexts—regardless of the privilege level of who configured them. Audit other integrations (monitoring tools, webhooks, notification handlers) for the same pattern: configuration values that originate in admin panels but render into public-facing pages. The fix requires proper script-context escaping at the render boundary, but the architectural lesson is that 'admin-controlled' describes who sets a value, not whether its render context is trusted.