# CVE-2026-39275: Cockpit CMS stored XSS in field-select and field-tags

Source: https://junglewise.ai/threats/cve-2026-39275-cockpit-cms-stored-xss-in-field-select-and-field-tags  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-26. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-39275 · Severity: medium · CVSS 6.1 · Published 2026-08-26

Cockpit CMS is a popular open-source content management system. A stored cross-site scripting vulnerability in its content collection interface allows low-privilege editors to inject malicious code that executes when administrators view item lists. An attacker can steal administrator session credentials and authentication tokens, leading to full account takeover and unauthorized administrative access.

## Quick answers

**Is CVE-2026-39275 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-39275 being exploited in the wild.

**How severe is CVE-2026-39275?** Medium severity, with a CVSS score of 6.1, published 26 August 2026.

**Which products and versions are affected?** Cockpit HQ Cockpit CMS 2.13.5 and before.

**Is there a fix for CVE-2026-39275?** A patch was published on 2026-03-29: Fix released by maintainers (commit d70dc50) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-39275 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-39275?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a stored XSS (CWE-79) in the field-tags.js and field-select.js Vue components. The root cause is that field render() output is passed directly to Vue's v-html directive without output encoding or sanitization. An attacker with content write access (via API key or authenticated editor session) can inject arbitrary JavaScript payloads into tags or select fields via the API. The payload persists in the database and executes in the browser of any administrator or editor who views the affected collection's item list. Additionally, Cockpit stores session cookies without the HttpOnly flag and exposes the CSRF JWT in JavaScript globals, allowing the injected XSS to steal both tokens and replay them for session hijacking. The fix involves sanitizing render output using App.utils.stripTags() before passing to v-html, and hardening session cookies with HttpOnly, Secure, and SameSite flags.

## Affected products

- Cockpit HQ Cockpit CMS 2.13.5 and before

## Timeline

- 2026-03-29: disclosed: Vulnerability reported to Cockpit CMS maintainers
- 2026-03-29: patched: Fix released by maintainers (commit d70dc50)
- 2026-04-04: advisory: CVE requested
- 2026-06-23: other: CVE-2026-39275 assigned
- 2026-08-26: other: Public disclosure

## References

- [https://github.com/Cockpit-HQ/Cockpit/commit/d70dc5059732fc97bd65aa3583cd0f88631a3c78](https://github.com/Cockpit-HQ/Cockpit/commit/d70dc5059732fc97bd65aa3583cd0f88631a3c78)
- [https://github.com/Securify-AI/CVE-2026-39275](https://github.com/Securify-AI/CVE-2026-39275)