CVE-2026-39275 in Cockpit
Summary
by MITRE • 08/26/2026
Cross Site Scripting vulnerability in Cockpit CMS v.2.13.5 and before allows a remote attacker to execute arbitrary code via the item.php, field-select.js and tags.js components.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/26/2026
The identified Cross-Site Scripting (XSS) vulnerability within Cockpit CMS versions 2.13.5 and earlier represents a significant security risk for web applications relying on this content management system. This flaw is specifically located in the client-side JavaScript files item.php, field-select.js, and tags.js, which are integral to the administrative interface's functionality. The core technical deficiency lies in the insufficient sanitization of user-supplied input before it is rendered within the browser context. When an attacker crafts a malicious payload containing executable script code, they can inject this content into fields that are subsequently processed by these specific components without proper validation or encoding. This lack of output encoding allows the injected scripts to execute directly in the victim's web browser, effectively bypassing standard security controls such as the Same-Origin Policy.
From an operational perspective, a successful exploitation of this vulnerability enables a remote attacker to perform actions that are typically restricted by the browser's same-origin policy. The most immediate impact involves session hijacking, where the attacker can steal authentication cookies or tokens associated with active user sessions. This allows the adversary to impersonate legitimate administrators and gain unauthorized access to sensitive areas of the CMS. Furthermore, the vulnerability facilitates defacement attacks, where malicious content is injected into web pages visible to other users, damaging organizational reputation. In more sophisticated scenarios, attackers may deploy keyloggers or redirect victims to phishing sites designed to harvest additional credentials. The ability to execute arbitrary JavaScript also opens the door for further exploitation chains, such as using the compromised session to exploit server-side vulnerabilities that require administrative privileges.
This vulnerability aligns with Common Weakness Enumeration (CWE) identifier CWE-79, which classifies Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The attack vector is categorized under MITRE ATT&CK technique T1059, specifically sub-technique 007 for JavaScript execution within a browser environment. This classification highlights the reliance on client-side script interpretation to achieve malicious objectives without requiring direct server compromise at the initial stage. The presence of this flaw in multiple components suggests a systemic issue with input handling practices across different modules of the CMS administration panel, indicating that the vulnerability is not isolated but rather pervasive throughout the user interface logic.
To mitigate this risk, immediate action should be taken to upgrade Cockpit CMS to version 2.13.6 or any later release where these specific components have been patched with proper input validation and output encoding mechanisms. For organizations unable to patch immediately due to compatibility constraints, implementing a Web Application Firewall (WAF) can provide an additional layer of defense by filtering out known malicious script patterns in HTTP requests targeting the affected endpoints. Additionally, administrators should enforce strict Content Security Policy headers that restrict the execution of inline scripts unless explicitly whitelisted, thereby reducing the impact if an injection attempt occurs. Regular security audits and code reviews focusing on data flow from user input to browser output are essential preventive measures to identify similar flaws in other parts of the application before they can be exploited by adversaries.