CVE-2026-38993: Path Traversal
Cockpit 2.13.5 and earlier is vulnerable to directory traversal via the Buckets component. This vulnerability allows authenticated attackers to write files to arbitrary locations within the uploads directory or overwrite assets with malicious versions.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-38993?
CVE-2026-38993 has a severity rating of high with a CVSS score of 8.1.
What is CVE-2026-38993?
CVE-2026-38993 is a directory traversal vulnerability in Cockpit versions 2.13.5 and earlier that allows authenticated attackers to write files to arbitrary locations within the uploads directory.
How do I fix CVE-2026-38993?
To fix CVE-2026-38993, update Cockpit to version 2.14.0 or later where the vulnerability is addressed.
What impact does CVE-2026-38993 have on my system?
CVE-2026-38993 can allow attackers to overwrite assets with malicious versions, potentially compromising the integrity of your system.
Who is affected by CVE-2026-38993?
Any user running Cockpit version 2.13.5 or earlier is at risk for CVE-2026-38993 if they have authenticated access.