Sign in
Deutsch English Español Polski
Critical

Cockpit is vulnerable to arbitrary code execution

  • Disclosed: 29.04.2026
  • Updated: 11.10.2026 10:22

Cockpit versions 2.13.5 and earlier are vulnerable to arbitrary code execution via the filter parameter within multiple endpoints. This vulnerability allows an attacker to run system commands on the underlying infrastructure via the MongoLite $func operator.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Composer package cockpit-hq/cockpit < 2.14.0 2.14.0

References

CVSS score 9.8/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE)
CWE-94
Platform
Composer
Package
cockpit-hq/cockpit
Disclosed
29.04.2026
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-fm6c-rhcf-7439 - CC BY 4.0

Vulnerability history: cockpit-hq/cockpit

All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (26) in the archive
Total entries
26
First → latest
08.2022 05.2026
Without a fix
9
Exploited in attacks
0

Severity breakdown

  • Critical 3
  • High 13
  • Medium 9
  • Low 1

Disclosures per year

Severity:
  1. Cockpit Vulnerable to Unrestricted Upload of File with Dangerous Type
    High · 8.8 CVE-2026-38991 < 2.14.0 2.14.0
  2. Cockpit is vulnerable to arbitrary code execution this entry
    Critical · 9.8 CVE-2026-38992 < 2.14.0 2.14.0
  3. Cockpit CMS has SQL Injection in MongoLite Aggregation Optimizer via toJsonExtractRaw()
    High · 7.7 CVE-2026-31891 < 2.13.5 2.13.5
  4. Cockpit Arbitrary File Upload
    High · 7.5 CVE-2025-1025 < 2.4.1 2.4.1
  5. Cockpit CMS contains an arbitrary file upload vulenrability
    Critical · 9.8 CVE-2024-4825 < 2.7.0 2.7.0
  6. Cockpit Cross-site Scripting vulnerability
    High · 8.3 CVE-2023-4433 <= 2.6.3 no fix
  7. Cockpit Cross-site Scripting vulnerability
    High · 8.3 CVE-2023-4432 <= 2.6.3 no fix
  8. Cockpit Cross-site Scripting vulnerability
    High · 8.1 CVE-2023-4395 <= 2.6.3 no fix
  9. Cockpit Cross-site Scripting vulnerability
    High · 8.3 CVE-2023-4321 <= 2.6.2 no fix
  10. Cockpit PHP Remote File Inclusion vulnerability
    Critical · 9.9 CVE-2023-4195 < 2.6.3 2.6.3
  11. Cockpit Cross-site Scripting vulnerability
    High · 8.3 CVE-2023-4196 < 2.6.3 2.6.3
  12. Cockpit CMS vulnerable to incorrect access control
    High · 7.5 CVE-2023-37649 < 2.6.0 2.6.0
  13. Cockpit CMS Cross-Site Request Forgery vulnerability
    High · 8.8 CVE-2023-37650 < 2.6.0 2.6.0
  14. cockpit-hq/cockpit is vulnerable to unrestricted file uploads
    High · 8.8 CVE-2023-1313 < 2.4.1 2.4.1
  15. privilege chaining in cockpit-hq/cockpit
    High · 8.8 CVE-2023-0759 < 2.3.8 2.3.8
  16. Cockpit Content Platform vulnerable to 2FA bypass
    High · 8.8 CVE-2022-2818 < 2.2.2 2.2.2

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.