Executive brief
Cockpit CMS is a popular content management platform used to store and manage digital assets including video files. An authenticated user with basic asset upload permissions can execute arbitrary system commands by uploading a video with specially crafted filenames containing shell metacharacters. This allows an attacker to take over the web server and potentially access sensitive customer data or launch further attacks on the infrastructure.
Technical details
The vulnerability is a command injection flaw in the FFmpeg integration module. The root cause is unsafe string interpolation: user-supplied filenames are directly interpolated into a shell command via Process::fromShellCommandline() before input sanitization runs. An authenticated attacker with assets/upload permission can exploit this by uploading a video file with a filename containing shell metacharacters (backticks, $(), semicolons, etc.) to escape the FFmpeg command context and execute arbitrary shell commands as the web-server user. The attack requires authentication but only basic upload privileges. A fix was implemented in a July 2026 commit that refactors the FFmpeg class to use Process with array arguments instead of shell command strings, eliminating the injection vector.
Affected products
- Cockpit Cockpit CMS 2.14.0 and prior
Timeline
- 2026-08-14: disclosed: Public disclosure of CVE-2026-73680
- 2026-07-05: patched: Fix implemented via commit 28813596f57685f63d3a48f655e8e9bd2b535cab refactoring FFmpeg/Vips classes to use Process with array arguments