VYPR
← All advisories
Moderate severityNVD Advisory· Published May 14, 2014· Updated May 6, 2026

CVE-2014-3225

CVE-2014-3225

Description

Absolute path traversal vulnerability in the web interface in Cobbler 2.4.x through 2.6.x allows remote authenticated users to read arbitrary files via the Kickstart field in a profile.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
cobblerPyPI
>= 2.6.0, < 2.6.42.6.4
cobblerPyPI
>= 2.4.0, < 2.4.72.4.7

Patches

2
8232c0e88ec7

Add strict kickstart check in the API, again should fix #939.

https://github.com/cobbler/cobblerJörgen MaasJul 29, 2014via ghsa
commit
1 file changed · +5 −1
  • cobbler/remote.py+5 −1 modified
    @@ -823,7 +823,11 @@ def modify_item(self,what,object_id,attribute,arg,token):
         # support 1.6 field name exceptions for backwards compat
         attribute = REMAP_COMPAT.get(attribute,attribute)
         method = obj.remote_methods().get(attribute, None)
-        if method == None:
+
+        if what == "system" and attribute == "kickstart":
+            self._validate_ks_template_path(arg)
+
+        if method is None:
             # it's ok, the CLI will send over lots of junk we can't process
             # (like newname or in-place) so just go with it.
             return False
f757e3096fcd

Add strict kickstart check in the API, again should fix #939.

https://github.com/cobbler/cobblerJörgen MaasJul 29, 2014via ghsa
commit
1 file changed · +5 −1
  • cobbler/remote.py+5 −1 modified
    @@ -823,7 +823,11 @@ def modify_item(self,what,object_id,attribute,arg,token):
         # support 1.6 field name exceptions for backwards compat
         attribute = REMAP_COMPAT.get(attribute,attribute)
         method = obj.remote_methods().get(attribute, None)
-        if method == None:
+
+        if what == "system" and attribute == "kickstart":
+            self._validate_ks_template_path(arg)
+
+        if method is None:
             # it's ok, the CLI will send over lots of junk we can't process
             # (like newname or in-place) so just go with it.
             return False

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

13

News mentions

0

No linked articles in our index yet.