CVE-2021-40324: Arbitrary File Write Vulnerability in Cobbler
Summary
CVE-2021-40324: Cobbler before 3.3.0 allows arbitrary file write operations via upload_log_data. Affects cobbler across 2 version ranges.
< 3.3.0
< d8f60bbf14a838c8c8a1dba98086b223e35fe70a
Fixed in d8f60bbf14a838c8c8a1dba98086b223e35fe70a. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Cobbler is a package available on PyPI that provides a network boot and package installation service. It is commonly used for managing Linux installation servers. Cobbler allows administrators to configure and manage various aspects of the installation process, including network booting, DHCP, DNS, and package selection. However, a vulnerability has been discovered in Cobbler versions prior to 3.3.0 that allows arbitrary file write operations through the upload_log_data functionality.
Vulnerability Detail
The vulnerability (CVE-2021-40324) in Cobbler allows an attacker to perform arbitrary file write operations by exploiting the upload_log_data feature. This can lead to unauthorized modification or creation of files on the system, potentially allowing an attacker to execute arbitrary code or escalate privileges. The vulnerability was introduced in version 0 of Cobbler and has been fixed in version 3.3.0.
How To Fix
Latest published version: 3.3.10 as of 23 Oct 2026
pip install --upgrade "cobbler==3.3.10"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
d8f60bbf14a838c8c8a1dba98086b223e35fe70a
This is the first release that contains the fix.
pip install --upgrade "cobbler==d8f60bbf14a838c8c8a1dba98086b223e35fe70a"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is strongly advised to upgrade to the fixed version as soon as possible.
Conclusion
In conclusion, the vulnerability (CVE-2021-40324) in Cobbler allows arbitrary file write operations, potentially leading to unauthorized code execution or privilege escalation. It is crucial to upgrade to Cobbler version 3.3.0 or later to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for cobbler →
FAQ
This vulnerability allows an attacker to write arbitrary files on the system, which can lead to unauthorized code execution or privilege escalation.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your version of Cobbler is affected by this vulnerability. Simply enter your Pipfile.lock and it will provide information on any vulnerabilities found.
There are no known public exploits for this vulnerability at the time of this report. However, it is important to patch your system to prevent any potential attacks.
Yes, this vulnerability can be exploited remotely if the Cobbler service is exposed to the internet. It is recommended to apply the fix as soon as possible to mitigate the risk.
Yes, you can find more details about this vulnerability in the official advisory from the PyPA Advisory Database (https://github.com/pypa/advisory-database/blob/main/vulns/cobbler/PYSEC-2021-374.yaml).
References
Related vulnerabilities
Recent vulnerabilities recorded for cobbler.
