Cockpit-Hq Cockpit vulnerabilities

CVE-2025-1025 [HIGH] CWE-434 CVE-2025-1025: Versions of the package cockpit-hq/cockpit before 2.4.1 are vulnerable to Arbitrary File Upload wher Versions of the package cockpit-hq/cockpit before 2.4.1 are vulnerable to Arbitrary File Upload where an attacker can use different extension to bypass the upload filter.

CVE-2026-38992 [CRITICAL] CWE-94 Cockpit is vulnerable to arbitrary code execution Cockpit is vulnerable to arbitrary code execution Cockpit versions 2.13.5 and earlier are vulnerable to arbitrary code execution via the filter parameter within multiple endpoints. This vulnerability allows an attacker to run system commands on the underlying infrastructure via the MongoLite $func operator.

CVE-2024-4825 [CRITICAL] CWE-434 Cockpit CMS contains an arbitrary file upload vulenrability Cockpit CMS contains an arbitrary file upload vulenrability A vulnerability has been discovered in Agentejo Cockpit CMS v0.5.5 that consists in an arbitrary file upload in ‘/media/api’ parameter via post request. An attacker could upload files to the server, compromising the entire infrastructure.

CVE-2023-4451 [MEDIUM] CWE-79 Cockpit Cross-site Scripting vulnerability Cockpit Cross-site Scripting vulnerability Cross-site Scripting (XSS) - Reflected in GitHub repository cockpit-hq/cockpit version 2.6.3 and prior. A patch is available at commit 30609466c817e39f9de1871559603e93cd4d0d0c and anticipated to be part of version 2.6.4.

CVE-2026-38991 [HIGH] CWE-434 Cockpit Vulnerable to Unrestricted Upload of File with Dangerous Type Cockpit Vulnerable to Unrestricted Upload of File with Dangerous Type Cockpit versions 2.13.5 and earlier are affected by a misconfiguration within the Bucket component _isFileTypeAllowed function where a specially crafted filename bypasses an extension filter. This allows an authenticated attacker to rename arbitrary files with the .php file extension enabling arbitrary code to be executed on th

CVE-2023-1313 [HIGH] CWE-434 cockpit-hq/cockpit is vulnerable to unrestricted file uploads cockpit-hq/cockpit is vulnerable to unrestricted file uploads Unrestricted Upload of File with Dangerous Type in GitHub repository cockpit-hq/cockpit prior to 2.4.1.

CVE-2026-31891 [MEDIUM] CWE-89 CVE-2026-31891: Cockpit is a headless content management system. Any Cockpit CMS instance running version 2.13.4 or Cockpit is a headless content management system. Any Cockpit CMS instance running version 2.13.4 or earlier with API access enabled is potentially affected by a a SQL Injection vulnerability in the MongoLite Aggregation Optimizer. Any deployment where the `/api/content/aggregate/{model}` endpoint is publicly accessible or reachable by untrusted users

CVE-2023-4195 [CRITICAL] CWE-98 Cockpit PHP Remote File Inclusion vulnerability Cockpit PHP Remote File Inclusion vulnerability PHP Remote File Inclusion in GitHub repository cockpit-hq/cockpit prior to 2.6.3. Users may upload php files through the system file upload utility to obtain remote code execution.

CVE-2026-6626 [MEDIUM] CWE-20 CVE-2026-6626: A vulnerability was detected in Cockpit-HQ Cockpit up to 2.13.5. Affected by this issue is some unkn A vulnerability was detected in Cockpit-HQ Cockpit up to 2.13.5. Affected by this issue is some unknown functionality of the component Asset Handler/Aggregate Handler. The manipulation results in improper neutralization of special elements in data query logic. It is possible to launch the attack remotely. The exploit is now public and may be used. The

CVE-2023-37649 [HIGH] Cockpit CMS vulnerable to incorrect access control Cockpit CMS vulnerable to incorrect access control Incorrect access control in the component `/models/Content` of Cockpit CMS v2.5.2 allows unauthorized attackers to access sensitive data.

CVE-2026-38993 [MEDIUM] CWE-22 Cockpit is vulnerable to directory traversal Cockpit is vulnerable to directory traversal Cockpit 2.13.5 and earlier is vulnerable to directory traversal via the Buckets component. This vulnerability allows authenticated attackers to write files to arbitrary locations within the uploads directory or overwrite assets with malicious versions.

CVE-2022-2818 [HIGH] CWE-212 Cockpit Content Platform vulnerable to 2FA bypass Cockpit Content Platform vulnerable to 2FA bypass Cockpit Content Platform through version 2.2.1 is vulnerable to a two-factor authentication (2FA) bypass. The 2FA secret is disclosed in a JWT token after user logs into their account, allowing an attacker to bypass the 2FA code. A patch is available on the `develop` branch and is expected to be part of version 2.2.2.

CVE-2023-0759 [HIGH] CWE-268 privilege chaining in cockpit-hq/cockpit privilege chaining in cockpit-hq/cockpit Privilege Chaining in GitHub repository cockpit-hq/cockpit prior to 2.3.8.

CVE-2023-37650 [HIGH] CWE-352 Cockpit CMS Cross-Site Request Forgery vulnerability Cockpit CMS Cross-Site Request Forgery vulnerability A Cross-Site Request Forgery (CSRF) in the Admin portal of Cockpit CMS v2.5.2 allows attackers to execute arbitrary Administrator commands.

CVE-2023-41564 [MEDIUM] CWE-434 Cockpit CMS arbitrary file upload vulnerability Cockpit CMS arbitrary file upload vulnerability An arbitrary file upload vulnerability in the Upload Asset function of Cockpit CMS v2.6.3 allows attackers to execute arbitrary code via uploading a crafted `.shtml` file.

CVE-2025-7053 [MEDIUM] CWE-79 Cockpit - Content Platform vulnerable to XSS through name or email argument names Cockpit - Content Platform vulnerable to XSS through name or email argument names A vulnerability was found in Cockpit versions up to 2.11.3. This issue affects some unknown processing instances of the file /system/users/save. The manipulation of the arguments "name" or "email" leads to cross-site scripting. The attack may be initiated remotely. Upgrading to version 2.11.4 will addres

CVE-2026-23695 [MEDIUM] CWE-79 CVE-2026-23695: Cockpit CMS through version 2.14.0, patched in commit 72a83fc, contains a stored cross-site scriptin Cockpit CMS through version 2.14.0, patched in commit 72a83fc, contains a stored cross-site scripting vulnerability in the Set field type's Display template option, where the template string is processed by the $interpolate function using new Function() and rendered via Vue's v-html directive without sanitization. An attacker with content/:models/man

CVE-2023-4321 [HIGH] CWE-79 Cockpit Cross-site Scripting vulnerability Cockpit Cross-site Scripting vulnerability Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit 2.6.2 and prior. A patch is available at commit 34ab31ee9362da51b9709e178469dbffd7717249.

CVE-2023-4432 [HIGH] CWE-79 Cockpit Cross-site Scripting vulnerability Cockpit Cross-site Scripting vulnerability Cross-site Scripting (XSS) - Reflected in GitHub repository cockpit-hq/cockpit version 2.6.3 and prior. A patch is available at commit 2a93d391fbd2dd9e730f65d43b29beb65903d195 and anticipated to be part of version 2.6.4.

CVE-2023-4395 [HIGH] CWE-79 Cockpit Cross-site Scripting vulnerability Cockpit Cross-site Scripting vulnerability Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit 2.6.3 and prior. A patch is available at commit 36d1d4d256cbbab028342ba10cc493e5c119172c and anticipated to be part of version 2.6.4.