{"id":"CVE-2026-38993","state":"PUBLISHED","title":"Cockpit 2.13.5 and earlier is vulnerable to directory traversal via the Buckets component. This vulnerability allows authenticated attackers to write files to arbitrary locations w","description":"Cockpit 2.13.5 and earlier is vulnerable to directory traversal via the Buckets component. This vulnerability allows authenticated attackers to write files to arbitrary locations within the uploads directory or overwrite assets with malicious versions.","publishedAt":"2026-04-29T00:00:00.000Z","updatedAt":"2026-07-15T01:02:20.581Z","severity":{"score":6.5,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","source":"CISA-ADP"},"assigner":"mitre","products":["n/a n/a"],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}],"references":["https://github.com/Cockpit-HQ/Cockpit/releases/tag/2.14.0","https://felsec.com/posts/cockpit-cms-2.13.5-multi-vulns/","https://access.redhat.com/security/cve/CVE-2026-38993","https://bugzilla.redhat.com/show_bug.cgi?id=2463843","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-38993.json"],"weaknesses":["CWE-22"],"ingestedAt":"2026-10-29T20:11:50.837Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/38xxx/CVE-2026-38993.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-38993","state":"PUBLISHED","datePublished":"2026-04-29T00:00:00.000Z","dateUpdated":"2026-07-15T01:02:20.581Z","assignerShortName":"mitre","assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","dateReserved":"2026-04-06T00:00:00.000Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"Cockpit 2.13.5 and earlier is vulnerable to directory traversal via the Buckets component. This vulnerability allows authenticated attackers to write files to arbitrary locations within the uploads directory or overwrite assets with malicious versions."}],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}],"references":[{"url":"https://github.com/Cockpit-HQ/Cockpit/releases/tag/2.14.0"},{"url":"https://felsec.com/posts/cockpit-cms-2.13.5-multi-vulns/"}],"problemTypes":[{"descriptions":[{"type":"text","lang":"en","description":"n/a"}]}],"providerMetadata":{"shortName":"mitre","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","dateUpdated":"2026-04-29T14:37:27.724Z"}},"adp":[{"title":"CISA ADP Vulnrichment","references":[{"url":"https://felsec.com/posts/cockpit-cms-2.13.5-multi-vulns/","tags":["exploit"]}],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"timestamp":"2026-04-29T20:13:30.246866Z","id":"CVE-2026-38993","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-22","type":"CWE","lang":"en","description":"CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-04-29T20:14:16.567Z"}},{"title":"Cockpit: Cockpit: Arbitrary file write via directory traversal in Buckets component","descriptions":[{"lang":"en","value":"A flaw was found in Cockpit. This vulnerability, identified as a directory traversal, allows authenticated attackers to write files to arbitrary locations within the uploads directory or overwrite existing assets with malicious versions. The exploitation occurs via the Buckets component. This could lead to unauthorized modification of data and potential system compromise."}],"affected":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"cockpit","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","packageName":"cockpit","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"cockpit","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"cockpit","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-38993","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2463843","name":"RHBZ#2463843","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-38993.json","tags":["x_sadp-csaf-vex"]}],"metrics":[{"other":{"content":{"namespace":"https://access.redhat.com/security/updates/classification/","value":"Important"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-22","description":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat-SADP","orgId":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","dateUpdated":"2026-07-15T01:02:20.581Z"},"datePublic":"2026-04-29T00:00:00.000Z","timeline":[{"lang":"en","time":"2026-04-29T16:00:53.685Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-04-29T00:00:00.000Z","value":"Made public."}],"x_adpType":"supplier","x_generator":{"engine":"sadp-cli 1.0.0"}}]}}}