CVE-2026-38993: Cockpit is vulnerable to directory traversal
Cockpit 2.13.5 and earlier is vulnerable to directory traversal via the Buckets component. This vulnerability allows authenticated attackers to write files to arbitrary locations within the uploads directory or overwrite assets with malicious versions.
Other sources
Cockpit is vulnerable to directory traversal
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/cockpit-hq/cockpitto a version that resolves this vulnerability.Fixed in 2.14.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-38993?
CVE-2026-38993 has a severity rating of high with a CVSS score of 8.1.
What is CVE-2026-38993?
CVE-2026-38993 is a directory traversal vulnerability in Cockpit versions 2.13.5 and earlier that allows authenticated attackers to write files to arbitrary locations within the uploads directory.
How do I fix CVE-2026-38993?
To fix CVE-2026-38993, update Cockpit to version 2.14.0 or later where the vulnerability is addressed.
What impact does CVE-2026-38993 have on my system?
CVE-2026-38993 can allow attackers to overwrite assets with malicious versions, potentially compromising the integrity of your system.
Who is affected by CVE-2026-38993?
Any user running Cockpit version 2.13.5 or earlier is at risk for CVE-2026-38993 if they have authenticated access.