GHSA-P46P-7PMJ-M34F Cockpit is vulnerable to directory traversal

Cockpit 2.13.5 and earlier is vulnerable to directory traversal via the Buckets component. This vulnerability allows authenticated attackers to write files to arbitrary locations within the uploads directory or overwrite assets with malicious versions...

CVE-2026-38993

The CVE-2026-38993 affects Cockpit 2.13.5 and earlier, where the Buckets component is vulnerable to directory traversal. Authenticated users can write files to arbitrary locations in the uploads directory or overwrite assets with malicious versions. The issue is described across multiple sources ...