File Type Bypass Vulnerability in Cockpit by Cockpit HQ
CVE-2026-38991

8.8HIGH

Key Information:

Vendor

Cockpit HQ

Status
Cockpit
Vendor
CVE Published:
29 April 2026

What is CVE-2026-38991?

Cockpit 2.13.5 and earlier versions feature a misconfiguration in the Bucket component's _isFileTypeAllowed function. This flaw can be exploited by an authenticated attacker who uses a specially crafted filename to bypass the intended file extension filter, allowing them to rename arbitrary files with a .php extension. This vulnerability may lead to the execution of arbitrary code on the server, posing significant security risks.

References

https://github.com/Cockpit-HQ/Cockpit/releases/tag/2.14.0
https://felsec.com/posts/cockpit-cms-2.13.5-multi-vulns/

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.