CVE-2026-38993 | THREATINT

Description

Cockpit 2.13.5 and earlier is vulnerable to directory traversal via the Buckets component. This vulnerability allows authenticated attackers to write files to arbitrary locations within the uploads directory or overwrite assets with malicious versions.

PUBLISHED Reserved 2026-04-06 | Published 2026-04-29 | Updated 2026-04-29 | Assigner mitre

References

felsec.com/posts/cockpit-cms-2.13.5-multi-vulns/ exploit

github.com/Cockpit-HQ/Cockpit/releases/tag/2.14.0

felsec.com/posts/cockpit-cms-2.13.5-multi-vulns/

cve.org (CVE-2026-38993)

nvd.nist.gov (CVE-2026-38993)

Download JSON