Executive brief
Cockpit is vulnerable to arbitrary code execution
Affected products
- Packagist cockpit-hq/cockpit
Junglewise Threat Intelligence
CVE-2026-38992: Cockpit is vulnerable to arbitrary code execution
CVE-2026-38992 · Severity: low · CVSS 3.1 · Published 2026-04-29
Technologies: cockpit-hq/cockpit (Packagist). Vendors: Packagist.
Related threats
- Cockpit CMS stored XSS in Set field type Display template
- Cockpit Vulnerable to Unrestricted Upload of File with Dangerous Type
- Cockpit CMS directory traversal in Buckets component
- Cockpit has NoSQL Injection Through Content Aggregation Pipelines
- Cockpit CMS has SQL Injection in MongoLite Aggregation Optimizer via toJsonExtractRaw()