CVE-2026-38993

Published: Apr 29, 2026Modified: Jul 15, 2026Deferred

8.1

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Exploitability: 2.8 / Impact: 5.2

Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c (Secondary)

Description

Cockpit 2.13.5 and earlier is vulnerable to directory traversal via the Buckets component. This vulnerability allows authenticated attackers to write files to arbitrary locations within the uploads directory or overwrite assets with malicious versions.

Related CWEs

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (6)

https://felsec.com/posts/cockpit-cms-2.13.5-multi-vulns/

Source: cve@mitre.org

https://github.com/Cockpit-HQ/Cockpit/releases/tag/2.14.0

Source: cve@mitre.org

https://access.redhat.com/security/cve/CVE-2026-38993

Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

https://bugzilla.redhat.com/show_bug.cgi?id=2463843

Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

https://felsec.com/posts/cockpit-cms-2.13.5-multi-vulns/

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-38993.json

Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

Timeline

No history available yet.