CVE Feed

    Dashboard / CVE / CVE-2026-38991

    CVE-2026-38991

    Cockpit 2.13.5 and earlier is affected by a misconfiguration within the Bucket component _isFileTypeAllowed function where a specially crafted filename bypasses an extension filter. This allows an authenticated attacker to rename arbitrary files with the .php file extension enabling arbitrary code to be executed on the underlying server.

    Published:Apr 29, 2026
    Last Modified:May 2, 2026
    EPS:Apr 29, 2026
    EPSS Score:0.00028
    CVSS Score:8.8

    Affected Products

    Vendor
    Cockpit-hq
    Product
    Cockpit

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs

    Related CVEs

    CVE-2026-82449 (CVSS 6.9) — Cockpit CMS before 2.14.1 contains an account enumeration vulnerability in the auth check endpoint due to timi…
    CVE-2026-73680 (CVSS 8.7) — Cockpit CMS 2.14.0 and prior contains a command injection vulnerability in the FFmpeg integration that allows …
    CVE-2026-23695 (CVSS 5.1) — Cockpit CMS through version 2.14.0, patched in commit 72a83fc, contains a stored cross-site scripting vulnerab…
    CVE-2026-34965 (CVSS 8.7) — Cockpit CMS contains an authenticated remote code execution vulnerability in the /cockpit/collections/save_col…
    CVE-2026-38993 (CVSS 6.5) — Cockpit 2.13.5 and earlier is vulnerable to directory traversal via the Buckets component. This vulnerability …
    CVE-2026-38992 (CVSS 9.8) — Cockpit v2.13.5 and earlier is vulnerable to arbitrary code execution via the filter parameter within multiple…
    CVE-2026-6626 (CVSS 2.1) — A vulnerability was detected in Cockpit-HQ Cockpit up to 2.13.5. Affected by this issue is some unknown functi…
    CVE-2026-31891 (CVSS 7.7) — Cockpit is a headless content management system. Any Cockpit CMS instance running version 2.13.4 or earlier wi…
    CVE-2025-7053 (CVSS 5.1) — A vulnerability was found in Cockpit up to 2.11.3. It has been rated as problematic. This issue affects some u…
    CVE-2025-1025 (CVSS 7.7) — Versions of the package cockpit-hq/cockpit before 2.4.1 are vulnerable to Arbitrary File Upload where an attac…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High