CVE-2023-41564

creationtimestamp| type| source ---|---|--- 2026-09-02 01:00:11+00:00| seen| Telegram/LQpXoSxiIMyLvjThS3pKr95lLo1oYU2fC4knuXd1KuqMh5Y 2026-09-03 00:00:54+00:00| published-proof-of-concept| Telegram/LQpXoSxiIMyLvjThS3pKr95lLo1oYU2fC4knuXd1KuqMh5Y...

CVE-2023-41564

An arbitrary file upload vulnerability in the Upload Asset function of Cockpit CMS v2.6.3 allows attackers to execute arbitrary code via uploading a crafted .shtml file...

CVE-2023-41564

An arbitrary file upload vulnerability in the Upload Asset function of Cockpit CMS v2.6.3 allows attackers to execute arbitrary code via uploading a crafted .shtml file...

CVE-2023-41564

An arbitrary file upload vulnerability in the Upload Asset function of Cockpit CMS v2.6.3 allows attackers to execute arbitrary code via uploading a crafted .shtml file...

CVE-2023-41564

Cockpit CMS v2.6.3 is vulnerable to arbitrary code execution via the Upload Asset function by uploading a crafted .shtml file to /assets/upload. The root cause is a missing ban of the .shtml extension in the forbiddenExtension list, allowing .shtml uploads that can execute server-side scripts. Th...