CVE-2026-38991
published 2026-04-29CVE-2026-38991: Cockpit 2.13.5 and earlier is affected by a misconfiguration within the Bucket component _isFileTypeAllowed function where a specially crafted filename…
PriorityP356high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
0.38%
29.4th percentile
Cockpit 2.13.5 and earlier is affected by a misconfiguration within the Bucket component _isFileTypeAllowed function where a specially crafted filename bypasses an extension filter. This allows an authenticated attacker to rename arbitrary files with the .php file extension enabling arbitrary code to be executed on the underlying server.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cockpit-hq | cockpit | >= 0 < 2.14.0 | 2.14.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Cockpit up to 2.13.5 Bucket _isFileTypeAllowed access control
vuldb·2026-04-29·CVSS 8.8
CVE-2026-38991 [HIGH] Cockpit up to 2.13.5 Bucket _isFileTypeAllowed access control
A vulnerability, which was classified as critical, was found in Cockpit up to 2.13.5. This issue affects the function _isFileTypeAllowed of the component Bucket. Executing a manipulation can lead to improper access controls.
This vulnerability is handled as CVE-2026-38991. The attack can be executed remotely. There is not any exploit available.
GHSA
Cockpit Vulnerable to Unrestricted Upload of File with Dangerous Type
ghsa·2026-04-29
CVE-2026-38991 [HIGH] CWE-434 Cockpit Vulnerable to Unrestricted Upload of File with Dangerous Type
Cockpit Vulnerable to Unrestricted Upload of File with Dangerous Type
Cockpit versions 2.13.5 and earlier are affected by a misconfiguration within the Bucket component _isFileTypeAllowed function where a specially crafted filename bypasses an extension filter. This allows an authenticated attacker to rename arbitrary files with the .php file extension enabling arbitrary code to be executed on the underlying server.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-04-29
Published