Medium severity6.5NVD Advisory· Published Apr 29, 2026· Updated Apr 29, 2026

CVE-2026-38993

Description

Cockpit 2.13.5 and earlier is vulnerable to directory traversal via the Buckets component. This vulnerability allows authenticated attackers to write files to arbitrary locations within the uploads directory or overwrite assets with malicious versions.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
cockpit-hq/cockpitPackagist	< 2.14.0	2.14.0

Affected products

ghsa-coords
pkg:composer/cockpit-hq/cockpit
Range: < 2.14.0

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-p46p-7pmj-m34fghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2026-38993ghsaADVISORY
felsec.com/posts/cockpit-cms-2.13.5-multi-vulnsghsaWEB
github.com/Cockpit-HQ/Cockpit/releases/tag/2.14.0nvdWEB
felsec.com/posts/cockpit-cms-2.13.5-multi-vulns/nvd

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000