Executive brief
Cockpit Vulnerable to Unrestricted Upload of File with Dangerous Type
Affected products
- Packagist cockpit-hq/cockpit
Junglewise Threat Intelligence
CVE-2026-38991: Cockpit Vulnerable to Unrestricted Upload of File with Dangerous Type
CVE-2026-38991 · Severity: low · CVSS 3.1 · Published 2026-04-29
Technologies: cockpit-hq/cockpit (Packagist). Vendors: Packagist.
Related threats
- Cockpit CMS stored XSS in Set field type Display template
- Cockpit CMS directory traversal in Buckets component
- Cockpit is vulnerable to arbitrary code execution
- Cockpit has NoSQL Injection Through Content Aggregation Pipelines
- Cockpit CMS has SQL Injection in MongoLite Aggregation Optimizer via toJsonExtractRaw()