CVE-2026-72557 in Cockpit-HQ
Summary
by MITRE • 08/11/2026
An unrestricted file upload vulnerability in Cockpit CMS 2.6.0 allows authenticated users to upload files of any extension including PHP scripts via the asset upload endpoint. The allowed_uploads configuration defaults to wildcard (*) and uploaded files are stored in a web-accessible directory. An attacker with any authenticated account can upload a PHP webshell and execute arbitrary OS commands on the server.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/11/2026
The vulnerability under examination represents a critical unrestricted file upload flaw in Cockpit CMS version 2.6.0 that fundamentally undermines the application's security posture through improper file validation mechanisms. This weakness enables authenticated users to bypass content restrictions by uploading malicious files with arbitrary extensions, including dangerous script types such as php webshells, which can execute arbitrary operating system commands on the compromised server. The vulnerability stems from a misconfigured allowed_uploads parameter that defaults to wildcard matching, allowing all file types to be uploaded without proper sanitization or validation checks.
The technical implementation of this flaw occurs through the asset upload endpoint where the application fails to enforce proper file type restrictions or content verification measures. When users authenticate and attempt to upload files, the system accepts any extension without validating whether the file content matches its declared type or if it contains potentially malicious code. The uploaded files are subsequently stored in a directory that is directly web-accessible, creating a direct path for attackers to execute their payloads through simple HTTP requests targeting the uploaded files. This configuration creates an ideal environment for remote code execution exploits where attackers can leverage the webshell capabilities to gain persistent access and control over the underlying server infrastructure.
The operational impact of this vulnerability extends beyond simple privilege escalation as it allows attackers with minimal authentication credentials to achieve full system compromise without requiring elevated privileges or sophisticated attack vectors. The default wildcard configuration in allowed_uploads parameter represents a fundamental security misconfiguration that violates principle of least privilege and proper input validation practices. This flaw aligns with CWE-434 which specifically addresses insecure file upload vulnerabilities where applications accept files without adequate validation or sanitization, making it particularly dangerous for web applications hosting sensitive data or serving critical business functions.
Security practitioners should note that this vulnerability directly maps to several ATT&CK techniques including T1059.007 for command and scripting interpreter with PowerShell or bash execution, and T1566 for phishing with social engineering elements that could facilitate initial access. The attack surface is significantly broadened by the fact that authentication is the only requirement for exploitation, making this vulnerability particularly concerning for multi-user environments where credential compromise could occur through various attack vectors including credential stuffing, phishing campaigns, or weak password practices. Organizations should implement immediate mitigations including explicit file type restrictions, content validation checks, and proper file storage segregation from web-accessible directories.
The recommended remediation approach involves configuring the allowed_uploads parameter to explicitly define permitted file extensions rather than relying on wildcard matching, implementing MIME type verification during file uploads, and ensuring that uploaded files are stored in non-web-accessible directories. Additionally, organizations should consider implementing additional security layers such as file content scanning for malicious code patterns, regular vulnerability assessments of third-party components, and comprehensive monitoring for unauthorized file upload activities. The incident highlights the critical importance of proper input validation and secure coding practices, particularly when dealing with user-provided content in web applications that may be exposed to untrusted inputs from authenticated users within the system's access control framework.