Command Injection Vulnerability in Cockpit CMS by Cockpit HQ

CVE-2026-73680

What is CVE-2026-73680?

Cockpit CMS versions 2.14.0 and earlier are vulnerable to a command injection flaw. This issue arises from the handling of filenames in the FFmpeg integration, allowing authenticated users with minimal permissions to execute arbitrary commands. When a video file is uploaded with a maliciously crafted filename containing shell metacharacters, the unsanitized input is directly interpolated into a shell command before it is processed by the slugify sanitizer. As a result, attackers may exploit this to inject their commands, which are then executed in the context of the web server, posing significant security risks.

References