What is the CVSS score of CVE-2026-72557?

CVE-2026-72557 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Cockpit CMS are affected by CVE-2026-72557?

Cockpit CMS versions through 2.6.0 contain a critical remote code execution vulnerability (CVE-2026-72557, CVSS 8.8) that allows any authenticated user to upload and execute malicious PHP files as…

How to fix or mitigate CVE-2026-72557?

Within 24 hours, audit all Cockpit CMS deployments to identify instances running versions 2.6.0 or earlier, with priority on internet-facing systems; document which systems have active user accounts and upload permissions enabled. Within 7 days, implement critical compensating controls: change the allowed_uploads configuration from the default wildcard (*) to an explicit allowlist of safe file extensions (jpg, png, gif, pdf only); either relocate the uploads directory outside the web root or disable direct web access using .htaccess or web server rules to prevent PHP execution; and restrict CMS administrative access to trusted IP addresses or VPN-only connectivity. Within 30 days, establish a vendor monitoring process for patch release announcements and prepare for immediate upgrade when available; if no patch emerges within 60 days, evaluate alternative CMS platforms or implement Web Application Firewall rules to inspect and block malicious file uploads.

Cockpit CMS CVE-2026-72557

EUVD-2026-56027 HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-08-11 TuranSec

GHSA-8gxj-mv75-3mrm

PHP File Upload Cockpit Cms

8.8

CVSS 3.1 · Vendor: TuranSec

Severity by source

Vendor (TuranSec) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-exploitable HTTP endpoint requiring only low-privilege authentication; PHP webshell execution yields complete confidentiality, integrity, and availability impact on the server.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (TuranSec).

CVSS VectorVendor: TuranSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 12:12 vuln.today

CVE Published

Aug 11, 2026 - 11:11 cve.org

HIGH 8.8

DescriptionCVE.org

An unrestricted file upload vulnerability in Cockpit CMS 2.6.0 allows authenticated users to upload files of any extension including PHP scripts via the asset upload endpoint. The allowed_uploads configuration defaults to wildcard (*) and uploaded files are stored in a web-accessible directory. An attacker with any authenticated account can upload a PHP webshell and execute arbitrary OS commands on the server.

Articles & Coverage 1

News 6 New PHP Vulnerabilities - 6 High Severity, No Public POC Aug 12, 2026

AnalysisAI

Unrestricted file upload in Cockpit CMS versions up to and including 2.6.0 allows any authenticated user to upload PHP scripts via the asset upload endpoint, achieving remote code execution as the web server process. The root cause is the default wildcard (*) value for the allowed_uploads configuration combined with storage of uploaded files in a web-accessible directory - a textbook CWE-434 condition. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the low barrier of entry (any authenticated account) makes this a high-priority remediation target for internet-facing deployments.

Technical ContextAI

Cockpit CMS is an open-source, PHP-based headless content management system used primarily for decoupled web architectures. The vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type): the asset upload endpoint performs no server-side validation of uploaded file extensions because the allowed_uploads configuration defaults to a wildcard (*), accepting all file types including executable PHP scripts. Critically, uploaded assets are stored in a web-accessible directory and served directly by the PHP-capable web server, meaning a PHP file uploaded as an asset can be triggered via a standard HTTP GET request and executed by the PHP runtime. The CPE string cpe:2.3:a:cockpit_cms:cockpit_cms:*:*:*:*:*:*:*:* encompasses all versions through 2.6.0. This is a well-understood vulnerability class with a deterministic exploitation path once file upload succeeds.

RemediationAI

No vendor-released patched version has been independently confirmed at time of analysis; administrators should monitor the upstream repository at https://github.com/Cockpit-HQ/Cockpit for a tagged release or security advisory addressing this issue. As an immediate compensating control, administrators should explicitly set the allowed_uploads configuration to a restrictive allowlist of safe, non-executable extensions such as jpg, png, gif, pdf, and docx - this directly neutralizes the default wildcard that enables the vulnerability, though it will prevent upload of any file type not on the allowlist. In addition, the web server should be configured to deny PHP script execution within the upload storage directory (e.g., an nginx location block with deny all for .php, or an Apache .htaccess file setting php_flag engine off); note this may break functionality if any legitimate server-side processing of uploaded assets is expected. Restricting the asset upload feature to administrator-level accounts only reduces the exposed attack surface but does not eliminate the underlying flaw if the configuration remains permissive.