GitHub Advisoryadvisory · Packagist

GHSA-p46p-7pmj-m34f Cockpit is vulnerable to directory traversal

MEDIUM Published 2026-04-29 Modified 2026-05-06 Official page ↗
Aliases
CVE-2026-38993
Ecosystem
Packagist
Packages
cockpit-hq/cockpit
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-22
Reviewed
2026-05-06

Affected packages

• Packagist cockpit-hq/cockpit: < 2.14.0 → fixed in 2.14.0

Description

Cockpit 2.13.5 and earlier is vulnerable to directory traversal via the Buckets component. This vulnerability allows authenticated attackers to write files to arbitrary locations within the uploads directory or overwrite assets with malicious versions.

Related

Alias · CVE (1)

  • CVE-2026-38993 Cockpit 2.13.5 and earlier is vulnerable to directory traversal via the Buckets component. vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References