CVE-2026-73680: Cockpit CMS 2.14.0 Authenticated Command Injection via FFmpeg Filename
Cockpit CMS 2.14.0 and prior contains a command injection vulnerability in the FFmpeg integration that allows authenticated users with only the assets/upload permission to execute arbitrary commands by uploading a video file with a shell metacharacter-laden filename. The unsanitized filename is interpolated into a shell command executed via Process::fromShellCommandline() before the slugify() sanitizer runs, enabling injected shell metacharacters such as backticks, $(), and semicolons to escape the FFmpeg command context and execute as the web-server user.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Cockpit CMSto a version that resolves this vulnerability.Fixed in 2.14.0 - Compensating control
Limit access to the Cockpit CMS FFmpeg video upload/FFmpeg integration so that only trusted users have the assets/upload permission, since authenticated users with only this permission can exploit shell metacharacters in the uploaded filename.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73680?
The severity of CVE-2026-73680 is rated as high with a score of 8.8.
How do I fix CVE-2026-73680?
To fix CVE-2026-73680, upgrade to Cockpit CMS version 2.14.1 or later where the vulnerability has been addressed.
What type of vulnerability is CVE-2026-73680?
CVE-2026-73680 is an OS command injection vulnerability caused by unsanitized file names in the FFmpeg integration.
Who is affected by CVE-2026-73680?
Authenticated users with the assets/upload permission on Cockpit CMS versions 2.14.0 and prior are affected by CVE-2026-73680.
What is the impact of CVE-2026-73680?
CVE-2026-73680 allows attackers to execute arbitrary commands on the server through crafted video file uploads.