GHSA-p46p-7pmj-m34f

ghsaUSosv

Cockpit is vulnerable to directory traversal

view advisory published 2026-04-29Licence: CC-BY-4.0

Cockpit 2.13.5 and earlier is vulnerable to directory traversal via the Buckets component. This vulnerability allows authenticated attackers to write files to arbitrary locations within the uploads directory or overwrite assets with malicious versions.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-38993US	—	0.84% (58th)	—	2026-04-29
Cockpit 2.13.5 and earlier is vulnerable to directory traversal via the Buckets component. This vulnerability allows authenticated attackers to write files to arbitrary locations w…

references

External citations — patches, advisories, analysis.

https://felsec.com/posts/cockpit-cms-2.13.5-multi-vulnsWEB
https://github.com/Cockpit-HQ/CockpitPACKAGE
https://github.com/Cockpit-HQ/Cockpit/releases/tag/2.14.0WEB
https://nvd.nist.gov/vuln/detail/CVE-2026-38993ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan