CVE-2026-72557: Cockpit CMS Cockpit CMS - Unrestricted File Upload
An unrestricted file upload vulnerability in Cockpit CMS 2.6.0 allows authenticated users to upload files of any extension including PHP scripts via the asset upload endpoint. The alloweduploads configuration defaults to wildcard () and uploaded files are stored in a web-accessible directory. An attacker with any authenticated account can upload a PHP webshell and execute arbitrary OS commands on the server.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Change Cockpit CMS configuration setting allowed_uploads from the default wildcard (*) to an explicit allow-list of permitted upload extensions so that PHP (and other executable script types) cannot be uploaded via the asset upload endpoint.
Cockpit CMS allowed_uploads = (restrict from wildcard '*') - Configuration
Move uploaded asset files out of the web-accessible directory (or otherwise ensure uploaded files cannot be executed/retrieved directly) because the configuration defaults store uploaded files in a web-accessible location.
Cockpit CMS asset upload storage location (web-accessible directory) = (not web-accessible)