CVE-2026-72557 — Cockpit CMS Cockpit CMS - Unrestricted File Upload
An unrestricted file upload vulnerability in Cockpit CMS 2.6.0 allows authenticated users to upload files of any extension including PHP scripts via the asset upload endpoint. T…
Published: 2026-08-11 · CVSS: 8.8 · CVSS 3.1
An unrestricted file upload vulnerability in Cockpit CMS 2.6.0 allows authenticated users to upload files of any extension including PHP scripts via the asset upload endpoint. The allowed_uploads configuration defaults to wildcard (*) and uploaded files are stored in a web-accessible directory. An attacker with any authenticated account can upload a PHP webshell and execute arbitrary OS commands on the server.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7