CVE Feed

    Dashboard / CVE / CVE-2026-38992

    CVE-2026-38992

    Cockpit v2.13.5 and earlier is vulnerable to arbitrary code execution via the filter parameter within multiple endpoints. This vulnerability allows an attacker to run system commands on the underlying infrastructure via the MongoLite $func operator.

    Published:Apr 29, 2026
    Last Modified:May 2, 2026
    EPS:Apr 29, 2026
    EPSS Score:0.00078
    CVSS Score:9.8

    Affected Products

    Vendor
    Cockpit-hq
    Product
    Cockpit

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-82449 (CVSS 6.9) — Cockpit CMS before 2.14.1 contains an account enumeration vulnerability in the auth check endpoint due to timi…
    CVE-2026-73680 (CVSS 8.7) — Cockpit CMS 2.14.0 and prior contains a command injection vulnerability in the FFmpeg integration that allows …
    CVE-2026-23695 (CVSS 5.1) — Cockpit CMS through version 2.14.0, patched in commit 72a83fc, contains a stored cross-site scripting vulnerab…
    CVE-2026-34965 (CVSS 8.7) — Cockpit CMS contains an authenticated remote code execution vulnerability in the /cockpit/collections/save_col…
    CVE-2026-38991 (CVSS 8.8) — Cockpit 2.13.5 and earlier is affected by a misconfiguration within the Bucket component _isFileTypeAllowed fu…
    CVE-2026-38993 (CVSS 6.5) — Cockpit 2.13.5 and earlier is vulnerable to directory traversal via the Buckets component. This vulnerability …
    CVE-2026-6626 (CVSS 2.1) — A vulnerability was detected in Cockpit-HQ Cockpit up to 2.13.5. Affected by this issue is some unknown functi…
    CVE-2026-31891 (CVSS 7.7) — Cockpit is a headless content management system. Any Cockpit CMS instance running version 2.13.4 or earlier wi…
    CVE-2025-7053 (CVSS 5.1) — A vulnerability was found in Cockpit up to 2.11.3. It has been rated as problematic. This issue affects some u…
    CVE-2025-1025 (CVSS 7.7) — Versions of the package cockpit-hq/cockpit before 2.4.1 are vulnerable to Arbitrary File Upload where an attac…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High