CVE-2026-73680 in Cockpit CMS
Summary
by MITRE • 08/14/2026
Cockpit CMS 2.14.0 and prior contains a command injection vulnerability in the FFmpeg integration that allows authenticated users with only the assets/upload permission to execute arbitrary commands by uploading a video file with a shell metacharacter-laden filename. The unsanitized filename is interpolated into a shell command executed via Process::fromShellCommandline() before the slugify() sanitizer runs, enabling injected shell metacharacters such as backticks, $(), and semicolons to escape the FFmpeg command context and execute as the web-server user.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/14/2026
This vulnerability exists within Cockpit CMS version 2.14.0 and earlier, representing a critical command injection flaw that exploits the file upload process through FFmpeg integration. The issue stems from inadequate input validation and sanitization of filenames during the media processing workflow, creating an attack vector for authenticated users who possess minimal permissions. Attackers with only assets/upload privileges can leverage this weakness to execute arbitrary commands on the server by crafting malicious filenames containing shell metacharacters.
The technical exploitation occurs through a specific sequence in the file processing pipeline where user-provided filenames undergo interpolation into shell commands without proper sanitization. The FFmpeg command construction uses Process::fromShellCommandline() function, which directly incorporates the unsanitized filename into the shell execution context before any sanitization occurs. This timing issue creates a window where metacharacters such as backticks, dollar parentheses, and semicolons can escape the intended command context and execute as part of the web server process. The vulnerability specifically targets the filename interpolation step, bypassing the subsequent slugify() sanitizer that would normally handle the sanitization.
The operational impact of this vulnerability is severe as it allows authenticated attackers to execute commands with the privileges of the web server user, potentially enabling full system compromise. Since the attack requires only basic upload permissions, it represents a significant privilege escalation threat within the application's access control model. The web server user typically has extensive file system access and can read/write application files, potentially leading to data exfiltration, persistence mechanisms, or further attacks against the underlying infrastructure. This vulnerability essentially provides attackers with a backdoor for arbitrary code execution that could be leveraged for reconnaissance, lateral movement, or complete system takeover.
Security professionals should prioritize immediate mitigation of this issue through version upgrades to Cockpit CMS 2.14.1 or later, which contain the necessary patches to address the command injection vulnerability. Additionally, implementing proper input validation and sanitization of filenames before shell command interpolation is crucial for preventing similar issues. Organizations should also enforce least privilege principles, limiting upload permissions to only trusted users and monitoring file upload activities for suspicious patterns. The vulnerability aligns with CWE-78 (Improper Neutralization of Special Elements used in OS Command) and maps to ATT&CK technique T1059.004 (Command and Scripting Interpreter: Unix Shell) within the adversary tactics and techniques framework, emphasizing the need for robust command execution controls and input validation mechanisms across all application components that interact with shell processes.