CVE-2026-23695: Cockpit CMS: Stored cross-site scripting vulnerability in the Set field type's Display template option
Cockpit CMS through version 2.14.0, patched in commit 72a83fc, contains a stored cross-site scripting vulnerability in the Set field type's Display template option, where the template string is processed by the $interpolate function using new Function() and rendered via Vue's v-html directive without sanitization. An attacker with content/:models/manage permission can inject arbitrary JavaScript into the Display template, which executes in the browser of any user viewing the collection items list.
Other sources
Cockpit CMS: Stored cross-site scripting vulnerability in the Set field type's Display template option
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Cockpit CMSto a version that resolves this vulnerability.Patch 72a83fc
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23695?
CVE-2026-23695 has a high severity rating due to its potential for exploitation through stored cross-site scripting.
How do I fix CVE-2026-23695?
To fix CVE-2026-23695, upgrade to Cockpit CMS version 2.14.1 or later, where the vulnerability has been patched.
Which versions of Cockpit CMS are affected by CVE-2026-23695?
CVE-2026-23695 affects Cockpit CMS versions up to and including 2.14.0.
What is the nature of the vulnerability in CVE-2026-23695?
CVE-2026-23695 is a stored cross-site scripting vulnerability that affects the Set field type's Display template option.
Is there a workaround for CVE-2026-23695 if I can't upgrade?
There are no official workarounds for CVE-2026-23695, and upgrading is the recommended action.