REDHAT-BUG-2463843: High severity Cockpit project Cockpit vulnerability

Q: Does exploiting this issue require authentication?

Yes. The issue is described as exploitable by authenticated attackers.

Q: Which deployments should be considered affected?

Cockpit versions 2.13.5 and earlier are affected where the Buckets component is in use.

Q: What could an attacker do after exploiting the flaw?

An authenticated attacker could write files to arbitrary locations within the uploads directory or overwrite assets with malicious versions.

Published Apr 29, 2026

Updated

Cockpit 2.13.5 and earlier is vulnerable to directory traversal via the Buckets component. This vulnerability allows authenticated attackers to write files to arbitrary locations within the uploads directory or overwrite assets with malicious versions.

Affected Software

1 affected component

Cockpit project Cockpit<=2.13.5

Event History

Apr 29, 2026

Data Sourced

via Red Hat·04:01 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Does exploiting this issue require authentication?

Yes. The issue is described as exploitable by authenticated attackers.

Which deployments should be considered affected?

Cockpit versions 2.13.5 and earlier are affected where the Buckets component is in use.

What could an attacker do after exploiting the flaw?

An authenticated attacker could write files to arbitrary locations within the uploads directory or overwrite assets with malicious versions.