Unrestricted File Upload in Cockpit CMS by Cockpit HQ

CVE-2026-72557

What is CVE-2026-72557?

An unrestricted file upload vulnerability exists in Cockpit CMS 2.6.0, allowing authenticated users to upload files of any type, including potentially malicious PHP scripts. The vulnerability arises because the allowed_uploads configuration is set to a wildcard (*), enabling users to upload files into a directory that is accessible via the web. An attacker holding any authenticated account could exploit this flaw by uploading a PHP webshell, which would grant them the ability to execute arbitrary OS commands on the server, significantly compromising the system's security.

References