CVE-2025-1025: Cockpit Arbitrary File Upload Vulnerability
Summary
CVE-2025-1025: Cockpit Arbitrary File Upload. Affects cockpit-hq/cockpit versions < 2.4.1. Fixed in 2.4.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Cockpit is an open-source web-based server management tool that allows users to manage their servers through a user-friendly interface. It provides features such as monitoring system performance, managing services, and handling storage. However, versions prior to 2.4.1 of the cockpit-hq/cockpit package are vulnerable to an arbitrary file upload issue, which can lead to severe security risks.
Vulnerability Detail
The vulnerability arises from an inadequate file upload filter in the cockpit-hq/cockpit package, allowing attackers to upload files with different extensions that bypass the security measures. This can lead to unauthorized access, data breaches, or the execution of malicious code on the server. The potential ramifications include compromised server integrity and unauthorized control over server resources.
How To Fix
Minimum fixed version
2.4.1
This is the first release that contains the fix.
composer require cockpit-hq/cockpit:2.4.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement strict file type validation on the server-side to prevent unauthorized file uploads. This can be done by checking the file extension and MIME type before processing the upload. However, this is not a substitute for updating the package.
Conclusion
The arbitrary file upload vulnerability in the cockpit-hq/cockpit package poses significant security risks. It is crucial to update to version 2.4.1 or later to mitigate these risks. Implementing additional file validation measures can serve as a temporary workaround, but updating the package is the most effective solution.
See every vulnerability recorded for cockpit-hq/cockpit →
FAQ
CVE-2025-1025 is a vulnerability in the cockpit-hq/cockpit package that allows arbitrary file uploads due to an inadequate upload filter.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The consequences include potential unauthorized access, data breaches, and execution of malicious code on the server.
Yes, the patch is available in version 2.4.1 of the cockpit-hq/cockpit package. Updating to this version will resolve the issue.
Vulert is a service that monitors and alerts for open-source vulnerabilities in software using just the composer.lock file, providing real-time updates.
References
Related vulnerabilities
Recent vulnerabilities recorded for cockpit-hq/cockpit.
