CVE-2026-34965: Cockpit CMS Authenticated Remote Code Execution via Collections
Cockpit CMS contains an authenticated remote code execution vulnerability in the /cockpit/collections/savecollection endpoint that allows authenticated attackers with collection management privileges to inject arbitrary PHP code into collection rules parameters. Attackers can inject malicious PHP code through rule parameters which is written directly to server-side PHP files and executed via include() to achieve arbitrary command execution on the underlying server.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34965?
CVE-2026-34965 is classified as a critical vulnerability due to its potential for authenticated remote code execution.
How do I fix CVE-2026-34965?
To fix CVE-2026-34965, it is recommended to update Cockpit CMS to the latest version where the vulnerability has been patched.
What impact does CVE-2026-34965 have on Cockpit CMS?
CVE-2026-34965 allows authenticated attackers with collection management privileges to execute arbitrary PHP code, potentially compromising the entire application.
Who is affected by CVE-2026-34965?
CVE-2026-34965 affects all versions of Agentejo Cockpit CMS that support collection management features.
How can I identify if CVE-2026-34965 is exploited in my system?
You can identify exploitation of CVE-2026-34965 by monitoring for unusual PHP code execution and tracking changes in collections managed by authenticated users.