CVE Feed

    Dashboard / CVE / CVE-2025-1025

    CVE-2025-1025

    Versions of the package cockpit-hq/cockpit before 2.4.1 are vulnerable to Arbitrary File Upload where an attacker can use different extension to bypass the upload filter.

    Published:Feb 5, 2025
    Last Modified:Apr 15, 2026
    EPS:Feb 5, 2025
    EPSS Score:0.04529
    CVSS Score:7.5

    Affected Products

    Vendor
    Cockpit-hq
    Product
    Cockpit

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs

    Related CVEs

    CVE-2026-82449 (CVSS 6.9) — Cockpit CMS before 2.14.1 contains an account enumeration vulnerability in the auth check endpoint due to timi…
    CVE-2026-73680 (CVSS 8.7) — Cockpit CMS 2.14.0 and prior contains a command injection vulnerability in the FFmpeg integration that allows …
    CVE-2026-23695 (CVSS 5.1) — Cockpit CMS through version 2.14.0, patched in commit 72a83fc, contains a stored cross-site scripting vulnerab…
    CVE-2026-34965 (CVSS 8.7) — Cockpit CMS contains an authenticated remote code execution vulnerability in the /cockpit/collections/save_col…
    CVE-2026-38991 (CVSS 8.8) — Cockpit 2.13.5 and earlier is affected by a misconfiguration within the Bucket component _isFileTypeAllowed fu…
    CVE-2026-38993 (CVSS 6.5) — Cockpit 2.13.5 and earlier is vulnerable to directory traversal via the Buckets component. This vulnerability …
    CVE-2026-38992 (CVSS 9.8) — Cockpit v2.13.5 and earlier is vulnerable to arbitrary code execution via the filter parameter within multiple…
    CVE-2026-6626 (CVSS 2.1) — A vulnerability was detected in Cockpit-HQ Cockpit up to 2.13.5. Affected by this issue is some unknown functi…
    CVE-2026-31891 (CVSS 7.7) — Cockpit is a headless content management system. Any Cockpit CMS instance running version 2.13.4 or earlier wi…
    CVE-2025-7053 (CVSS 5.1) — A vulnerability was found in Cockpit up to 2.11.3. It has been rated as problematic. This issue affects some u…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High