CVE-2010-2235: Cobbler Code Injection Vulnerability
Summary
CVE-2010-2235: Cobbler is vulnerable to code injection. Affects cobbler versions < 2.0.7. Fixed in 2.0.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Cobbler is an open-source Linux installation server that facilitates the management of network installations. It allows users to create and manage kickstart files, which automate the installation of operating systems. Cobbler is widely used in environments where multiple systems need to be deployed efficiently. However, prior to version 2.0.7, Cobbler's template engine, Cheetah, did not adequately restrict the execution of Python statements within templates, leading to potential security risks.
Vulnerability Detail
The vulnerability exists in the template_api.py file of Cobbler versions before 2.0.7. It allows remote authenticated administrators to execute arbitrary Python code through crafted kickstart template files. This poses a significant risk as it can lead to unauthorized access, data manipulation, or system compromise, making it crucial for users to address this issue promptly.
How To Fix
Latest published version: 3.3.10 as of 23 Oct 2026
pip install --upgrade "cobbler==3.3.10"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.0.7
This is the first release that contains the fix.
pip install --upgrade "cobbler==2.0.7"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, administrators can restrict access to the Cobbler template files to trusted users only, thereby minimizing the risk of exploitation until the package can be updated.
Conclusion
The CVE-2010-2235 vulnerability in Cobbler poses a serious risk due to its potential for code injection via crafted templates. Users are strongly advised to update to version 2.0.7 or later to mitigate this risk. Until an update can be applied, restricting access to template files is recommended.
See every vulnerability recorded for cobbler →
FAQ
The vulnerability allows remote authenticated users to execute arbitrary Python code, which can lead to unauthorized access and potential system compromise.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Cobbler versions prior to 2.0.7 are affected by this vulnerability.
Yes, the vulnerability is patched in Cobbler version 2.0.7 and later.
If an immediate update is not possible, restrict access to the template files to trusted users as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for cobbler.
