CVE-2026-38993: Cockpit Package Directory Traversal Vulnerability
Summary
CVE-2026-38993: Cockpit is vulnerable to directory traversal. Affects cockpit-hq/cockpit versions < 2.14.0. Fixed in 2.14.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Cockpit is an open-source web-based server management tool designed to simplify the administration of servers. It provides a user-friendly interface for managing system services, storage, networking, and more. The application is widely used for its ease of use and powerful features, but it is vulnerable to a directory traversal issue in versions 2.13.5 and earlier, which could allow unauthorized file access and manipulation.
Vulnerability Detail
The vulnerability arises from the Buckets component of Cockpit, which is susceptible to directory traversal attacks. Authenticated attackers can exploit this flaw to write files to arbitrary locations within the uploads directory or overwrite existing assets with malicious versions. This could lead to unauthorized access to sensitive data or the execution of malicious code, posing a significant risk to the integrity and security of the affected systems.
How To Fix
Minimum fixed version
2.14.0
This is the first release that contains the fix.
composer require cockpit-hq/cockpit:2.14.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the uploads directory and implement strict validation on file uploads to prevent unauthorized file manipulation. However, this is not a substitute for applying the official patch.
Conclusion
The directory traversal vulnerability in Cockpit versions 2.13.5 and earlier poses a significant risk to system security. It is crucial to update to version 2.14.0 or later to protect against potential exploitation. Additionally, utilizing tools like Vulert can help monitor and manage vulnerabilities in your open-source dependencies effectively.
See every vulnerability recorded for cockpit-hq/cockpit →
FAQ
The CVSS score of this vulnerability is 6.5, indicating a moderate severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploitation of this vulnerability could lead to unauthorized file access, data manipulation, and potential execution of malicious code, compromising system integrity.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software by analyzing the composer.lock file.
If an immediate update is not possible, implement strict access controls and file validation as a temporary measure to mitigate the risk until the update can be applied.
Related vulnerabilities
Recent vulnerabilities recorded for cockpit-hq/cockpit.
