CVE-2026-38993
Cockpit: Cockpit: Arbitrary file write via directory traversal in Buckets component
Severity
ImportantRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · April 29, 2026
Updated · November 5, 2026
Description
A flaw was found in Cockpit. This vulnerability, identified as a directory traversal, allows authenticated attackers to write files to arbitrary locations within the uploads directory or overwrite existing assets with malicious versions. The exploitation occurs via the Buckets component. This could lead to unauthorized modification of data and potential system compromise.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 8.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory