CVE-2026-23695: Cockpit CMS 2.14.0 Stored XSS via Set Field Display Template
Cockpit CMS through version 2.14.0, patched in commit 72a83fc, contains a stored cross-site scripting vulnerability in the Set field type's Display template option, where the template string is processed by the $interpolate function using new Function() and rendered via Vue's v-html directive without sanitization. An attacker with content/:models/manage permission can inject arbitrary JavaScript into the Display template, which executes in the browser of any user viewing the collection items list.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Cockpit CMSto a version that resolves this vulnerability.Fixed in 2.14.0Patch 72a83fc
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23695?
CVE-2026-23695 has a high severity rating due to its potential for exploitation through stored cross-site scripting.
How do I fix CVE-2026-23695?
To fix CVE-2026-23695, upgrade to Cockpit CMS version 2.14.1 or later, where the vulnerability has been patched.
Which versions of Cockpit CMS are affected by CVE-2026-23695?
CVE-2026-23695 affects Cockpit CMS versions up to and including 2.14.0.
What is the nature of the vulnerability in CVE-2026-23695?
CVE-2026-23695 is a stored cross-site scripting vulnerability that affects the Set field type's Display template option.
Is there a workaround for CVE-2026-23695 if I can't upgrade?
There are no official workarounds for CVE-2026-23695, and upgrading is the recommended action.