CVE-2026-38991: Malicious File Upload
Cockpit 2.13.5 and earlier is affected by a misconfiguration within the Bucket component isFileTypeAllowed function where a specially crafted filename bypasses an extension filter. This allows an authenticated attacker to rename arbitrary files with the .php file extension enabling arbitrary code to be executed on the underlying server.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-38991?
CVE-2026-38991 has been classified as a medium severity vulnerability due to its potential to allow attackers to execute arbitrary code.
How do I fix CVE-2026-38991?
To fix CVE-2026-38991, upgrade to Cockpit version 2.14.0 or later, which addresses the misconfiguration issue.
Who is affected by CVE-2026-38991?
CVE-2026-38991 affects all versions of Cockpit up to and including 2.13.5.
What type of vulnerability is CVE-2026-38991?
CVE-2026-38991 is a misconfiguration vulnerability that allows an attacker to bypass file extension restrictions.
Can CVE-2026-38991 be exploited remotely?
CVE-2026-38991 requires authentication, meaning it cannot be exploited remotely without valid credentials.