EUVD-2026-66750

Cross Site Scripting vulnerability in Cockpit CMS v.2.13.5 and before allows a remote attacker to execute arbitrary code via the item.php, field-select.js and tags.js components...

CVE-2026-73680

Cockpit CMS 2.14.0 and prior contains a command injection vulnerability in the FFmpeg integration that allows authenticated users with only the assets/upload permission to execute arbitrary commands by uploading a video file with a shell metacharacter-laden filename. The unsanitized filename is...

CVE-2026-73680 Cockpit CMS 2.14.0 Authenticated Command Injection via FFmpeg Filename

Cockpit CMS 2.14.0 and prior contains a command injection vulnerability in the FFmpeg integration that allows authenticated users with only the assets/upload permission to execute arbitrary commands by uploading a video file with a shell metacharacter-laden filename. The unsanitized filename is...

EUVD-2026-58799

Cockpit CMS 2.14.0 and prior contains a command injection vulnerability in the FFmpeg integration that allows authenticated users with only the assets/upload permission to execute arbitrary commands by uploading a video file with a shell metacharacter-laden filename. The unsanitized filename is...

CVE-2026-73680 Cockpit CMS 2.14.0 Authenticated Command Injection via FFmpeg Filename

Cockpit CMS 2.14.0 and prior contains a command injection vulnerability in the FFmpeg integration that allows authenticated users with only the assets/upload permission to execute arbitrary commands by uploading a video file with a shell metacharacter-laden filename. The unsanitized filename is...

CVE-2026-73680

Cockpit CMS 2.14.0 and earlier exposes a command-injection vulnerability in the FFmpeg integration. An authenticated user with assets/upload can upload a video file whose filename contains shell metacharacters; the unsanitized filename is interpolated into a shell command executed via Process::fr...

PT-2026-72118

Name of the Vulnerable Software and Affected Versions Cockpit CMS versions prior to 2.14.1 Description An issue in the FFmpeg integration allows authenticated users with assets/upload permissions to execute arbitrary commands. This occurs when a video file is uploaded with a filename containing...

CVE-2026-72557

An unrestricted file upload vulnerability in Cockpit CMS 2.6.0 allows authenticated users to upload files of any extension including PHP scripts via the asset upload endpoint. The alloweduploads configuration defaults to wildcard and uploaded files are stored in a web-accessible directory. An...

CVE-2026-72557

Cockpit CMS 2.6.0 is affected by an unrestricted file upload in the asset upload endpoint. The issue arises from allowed_uploads defaulting to a wildcard (*) and storing uploads in a web-accessible directory, enabling any authenticated user to upload files with arbitrary extensions (including PHP...

CVE-2026-72557 Cockpit CMS Cockpit CMS - Unrestricted File Upload

An unrestricted file upload vulnerability in Cockpit CMS 2.6.0 allows authenticated users to upload files of any extension including PHP scripts via the asset upload endpoint. The alloweduploads configuration defaults to wildcard and uploaded files are stored in a web-accessible directory. An...

CVE-2026-72557

An unrestricted file upload vulnerability in Cockpit CMS 2.6.0 allows authenticated users to upload files of any extension including PHP scripts via the asset upload endpoint. The alloweduploads configuration defaults to wildcard and uploaded files are stored in a web-accessible directory. An...

CVE-2026-72557 Cockpit CMS Cockpit CMS - Unrestricted File Upload

An unrestricted file upload vulnerability in Cockpit CMS 2.6.0 allows authenticated users to upload files of any extension including PHP scripts via the asset upload endpoint. The alloweduploads configuration defaults to wildcard and uploaded files are stored in a web-accessible directory. An...

EUVD-2026-56027

An unrestricted file upload vulnerability in Cockpit CMS 2.6.0 allows authenticated users to upload files of any extension including PHP scripts via the asset upload endpoint. The alloweduploads configuration defaults to wildcard and uploaded files are stored in a web-accessible directory. An...

PT-2026-70132

Name of the Vulnerable Software and Affected Versions Cockpit CMS version 2.6.0 Description An unrestricted file upload issue allows authenticated users to upload files with any extension, including PHP scripts, through the asset upload endpoint. This occurs because the allowed uploads...

VulnCheck KEV: CVE-2026-38992

Cockpit v2.13.5 and earlier is vulnerable to arbitrary code execution via the filter parameter within multiple endpoints. This vulnerability allows an attacker to run system commands on the underlying infrastructure via the MongoLite $func operator...

CVE-2026-57856

Cockpit CMS contains a path traversal vulnerability in the Bucket file storage API /system/buckets/api. The api method in modules/System/Controller/Buckets.php sanitizes the bucket name with pregreplace'/^a-zA-Z0-9-\./','', $bucket, which permits '..' and '../' sequences. The sanitized value is...

CVE-2026-57855

Cockpit CMS contains a missing authorization vulnerability in the Bucket file storage API /system/buckets/api. The api method in modules/System/Controller/Buckets.php executes bucket commands ls, upload, removefiles, rename, createfolder without performing any ACL or role check. Any authenticated...

CVE-2026-57856

Cockpit CMS exposes a path traversal in the Bucket file storage API (/system/buckets/api). The api() function sanitizes the bucket name with a regex that still allows ".." and "../" sequences, which are then interpolated into uploads://buckets/{bucket} and not blocked by Flysystem’s WhitespacePat...

CVE-2026-57856 Cockpit CMS Path Traversal via Bucket Name in Bucket File Storage API

Cockpit CMS contains a path traversal vulnerability in the Bucket file storage API /system/buckets/api. The api method in modules/System/Controller/Buckets.php sanitizes the bucket name with pregreplace'/^a-zA-Z0-9-\./','', $bucket, which permits '..' and '../' sequences. The sanitized value is...

CVE-2026-57856

Cockpit CMS contains a path traversal vulnerability in the Bucket file storage API /system/buckets/api. The api method in modules/System/Controller/Buckets.php sanitizes the bucket name with pregreplace'/^a-zA-Z0-9-\./','', $bucket, which permits '..' and '../' sequences. The sanitized value is...