What is the CVSS score of CVE-2026-38991?

CVE-2026-38991 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Cockpit CMS are affected by CVE-2026-38991?

Cockpit CMS versions 2.13.5 and earlier contain a critical remote code execution vulnerability that allows authenticated low-privilege users to upload and execute arbitrary PHP code by bypassing file…. A patch is available.

How to fix or mitigate CVE-2026-38991?

Within 24 hours: Identify all Cockpit CMS deployments and document versions currently in use; restrict file upload functionality via web server configuration (disable PHP execution in upload directories via .htaccess or nginx config). Within 7 days: Implement strict input validation at the application level, enforce PHP execution restrictions in upload directories, and monitor upload/file activity for suspicious patterns. Within 30 days: Upgrade to Cockpit CMS version 2.14.0 or later once vendor patch is released; conduct access audit to identify low-privilege accounts with upload permissions and apply principle of least privilege.

Cockpit CMS CVE-2026-38991

EUVD-2026-26242 HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-04-29 mitre

GHSA-j2rx-4jg9-79mw

PHP RCE File Upload

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 29, 2026 - 21:37 vuln.today

cvss_changed

Source Code Evidence Fetched

Apr 29, 2026 - 21:22 vuln.today

Analysis Generated

Apr 29, 2026 - 21:22 vuln.today

CVSS changed

Apr 29, 2026 - 21:22 NVD

8.8 (None) 8.8 (HIGH)

EUVD ID Assigned

Apr 29, 2026 - 15:30 euvd

EUVD-2026-26242

Analysis Generated

Apr 29, 2026 - 15:30 vuln.today

CVE Published

Apr 29, 2026 - 00:00 nvd

HIGH 8.8

DescriptionCVE.org

Cockpit 2.13.5 and earlier is affected by a misconfiguration within the Bucket component _isFileTypeAllowed function where a specially crafted filename bypasses an extension filter. This allows an authenticated attacker to rename arbitrary files with the .php file extension enabling arbitrary code to be executed on the underlying server.

AnalysisAI

Remote code execution in Cockpit CMS 2.13.5 and earlier allows authenticated users with low privileges to execute arbitrary PHP code on the server. Attackers exploit a filter bypass in the Bucket component's _isFileTypeAllowed function by crafting filenames that evade extension validation, then renaming files to .php for execution. Public proof-of-concept exists (SSVC: poc). EPSS data unavailable, but CVSS 8.8 with network vector and low attack complexity indicates high exploitability once authenticated.

Technical ContextAI

Cockpit CMS is a PHP-based headless content management system. The vulnerability resides in the Bucket component's _isFileTypeAllowed function, which performs inadequate validation of file extensions during upload or rename operations. The flaw is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). The filter can be bypassed through specially crafted filenames-likely using null bytes, double extensions, case manipulation, or Unicode encoding tricks common to PHP file upload vulnerabilities. Once an attacker renames an uploaded file to have a .php extension, the web server's PHP interpreter executes the file content as code. Version 2.14.0 release notes explicitly mention 'Fix Bucket path traversal vulnerability' and 'Enhance SVG file handling during uploads', indicating vendor awareness of file handling issues in the Bucket component.

RemediationAI

Upgrade to Cockpit CMS version 2.14.0 or later immediately, available at https://github.com/Cockpit-HQ/Cockpit/releases/tag/2.14.0. The release notes confirm fixes for Bucket path traversal and enhanced SVG file handling addressing the upload validation issues. If immediate patching is not feasible, implement these compensating controls with noted limitations: (1) Restrict Bucket component access to only highly trusted administrators through ACL configuration-reduces attack surface but limits CMS functionality for content editors; (2) Configure PHP disable_functions directive to block system(), exec(), passthru(), shell_exec(), and other code execution functions-may break legitimate CMS features requiring system calls; (3) Deploy Web Application Firewall rules blocking .php in uploaded filenames and monitoring for file rename operations-sophisticated bypass techniques may evade signature-based detection; (4) Set web server to deny execution of PHP files in upload directories via .htaccess (Apache) or location blocks (Nginx)-effective but verify configuration inheritance in nested directories. All compensating controls provide partial defense-in-depth but cannot fully eliminate risk given the fundamental validation flaw. Vendor patch remains the definitive remediation.