CVE-2026-38991
HIGH8.8EPSS 0.03%Cockpit Vulnerable to Unrestricted Upload of File with Dangerous Type
發布日:2026/4/29修改日:2026/5/6
描述
Cockpit versions 2.13.5 and earlier are affected by a misconfiguration within the Bucket component _isFileTypeAllowed function where a specially crafted filename bypasses an extension filter. This allows an authenticated attacker to rename arbitrary files with the .php file extension enabling arbitrary code to be executed on the underlying server.
受影響套件(1)
- Packagist/cockpit-hq/cockpitfrom 0, < 2.14.0
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |