EUVD-2026-26242
GHSA-j2rx-4jg9-79mw
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
7DescriptionNVD
Cockpit 2.13.5 and earlier is affected by a misconfiguration within the Bucket component _isFileTypeAllowed function where a specially crafted filename bypasses an extension filter. This allows an authenticated attacker to rename arbitrary files with the .php file extension enabling arbitrary code to be executed on the underlying server.
AnalysisAI
Remote code execution in Cockpit CMS 2.13.5 and earlier allows authenticated users with low privileges to execute arbitrary PHP code on the server. Attackers exploit a filter bypass in the Bucket component's _isFileTypeAllowed function by crafting filenames that evade extension validation, then renaming files to .php for execution. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Identify all Cockpit CMS deployments and document versions currently in use; restrict file upload functionality via web server configuration (disable PHP execution in upload directories via .htaccess or nginx config). Within 7 days: Implement strict input validation at the application level, enforce PHP execution restrictions in upload directories, and monitor upload/file activity for suspicious patterns. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today