CVE-2026-72557 — Cockpit CMS Cockpit CMS - Unrestricted File Upload

CVE-2026-72557

Cockpit CMS Cockpit CMS - Unrestricted File Upload PUBLISHED

Description (CNA)

An unrestricted file upload vulnerability in Cockpit CMS 2.6.0 allows authenticated users to upload files of any extension including PHP scripts via the asset upload endpoint. The allowed_uploads configuration defaults to wildcard (*) and uploaded files are stored in a web-accessible directory. An attacker with any authenticated account can upload a PHP webshell and execute arbitrary OS commands on the server.

Affected (CNA)

Vendor / product	Versions
Cockpit CMS / Cockpit CMS	affected 0 through 2.6.0

CWE

CWE-434

References

https://github.com/Cockpit-HQ/Cockpit

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.