Cockpit-hq vulnerabilities
We track 4 vulnerabilities in Cockpit-hq products across 2 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on August 14, 2026.
Latest Cockpit-hq vulnerabilities
- 8.8 High severity
Cockpit CMS: Improper Neutralization of Special Elements used in an OS Command
Cockpit CMS 2.14.0 and prior contains a command injection vulnerability in the FFmpeg integration that allows authenticated users with only the assets/upload permission to execute arbitrary commands by uploading a video file with a shell metacharacter-laden fi
- 8.8 High severity
Cockpit CMS: Improper Limitation of a Pathname to a Restricted Directory
Cockpit CMS contains a path traversal vulnerability in the Bucket file storage API (/system/buckets/api). The api() method in modules/System/Controller/Buckets.php sanitizes the bucket name with preg_replace('/[^a-zA-Z0-9-_\\.]/','', $bucket), which permits '.
- 8.8 High severity
Cockpit CMS: Improper Access Control
Cockpit CMS contains a missing authorization vulnerability in the Bucket file storage API (/system/buckets/api). The api() method in modules/System/Controller/Buckets.php executes bucket commands (ls, upload, removefiles, rename, createfolder) without performi
- 7.5 High severity
cockpit: Improper Limitation of a Pathname to a Restricted Directory
Cockpit CMS through 2.14.0 contains a path traversal and local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files or execute PHP files by including unvalidated PATH_INFO derived from REQUEST_URI in filesystem path constr