CVE-2026-73680 Cockpit HQ CVE debrief

Who should care

Administrators and users of Cockpit CMS 2.14.0 and prior, especially those with assets/upload permissions, should be aware of this vulnerability and take necessary defensive actions. This includes reviewing and restricting assets/upload permissions, monitoring for suspicious video file uploads and filenames, and implementing additional sanitization for filenames and shell commands. Consider compensating controls such as web application firewalls to mitigate the risk of exploitation. Users with limited permissions can execute arbitrary commands via FFmpeg filename injection, highlighting the importance of securing the upload process and validating user input. Affected operators, platforms, and security teams should prioritize patching or mitigating this vulnerability to prevent potential attacks. Vulnerability management and security teams should track exceptions, retest remediated assets, and close the item only after evidence is documented. This vulnerability affects Cockpit CMS versions 2.14.0 and prior, and users should verify their deployments and assign an owner for follow-up. Compensating controls, such as monitoring and detection, should be reviewed for exposed systems while remediation is scheduled and verified. The CVE record indicates a command injection vulnerability in Cockpit CMS 2.14.0 and prior, allowing authenticated users with assets/upload permission to execute arbitrary commands by uploading a video file with a malicious filename. The filename is unsanitized and interpolated into a shell command executed via Process::fromShellCommandline() before the slugify() sanitizer runs. The vulnerability has a CVSS score of 8.7 and is classified as HIGH severity. The vulnerability allows authenticated users with limited permissions to execute arbitrary commands via FFmpeg filename injection, highlighting the importance of securing the upload process and validating user input. The vulnerability affects Cockpit CMS versions 2.14.0 and prior, and users should verify their deployments and assign an owner for follow-up. The CVE record was published on 2026-08-14T20:16:58.080Z and has not been modified since then. The NVD detail page and source-specific vulner

Technical summary

The CVE-2026-73680 vulnerability in Cockpit CMS 2.14.0 and prior allows authenticated users with assets/upload permission to execute arbitrary commands. This is achieved by uploading a video file with a filename containing shell metacharacters, which are interpolated into a shell command executed via Process::fromShellCommandline() before sanitization. The vulnerability has a CVSS score of 8.7 and is classified as HIGH severity. The unsanitized filename is interpolated into a shell command executed via Process::fromShellCommandline() before the slugify() sanitizer runs, enabling injected shell metacharacters such as backticks, $(), and semicolons to escape the FFmpeg command context and execute as the web-server user.

Defensive priority

Authenticated users with limited permissions can execute arbitrary commands via FFmpeg filename injection.

Recommended defensive actions

• Inventory and verify Cockpit CMS versions 2.14.0 and prior.
• Restrict assets/upload permissions to trusted users.
• Monitor for suspicious video file uploads and filenames.
• Implement additional sanitization for filenames and shell commands.
• Consider compensating controls such as web application firewalls.

Evidence notes

The CVE-2026-73680 record indicates a command injection vulnerability in Cockpit CMS 2.14.0 and prior. The vulnerability allows authenticated users with assets/upload permission to execute arbitrary commands by uploading a video file with a malicious filename. The filename is unsanitized and interpolated into a shell command executed via Process::fromShellCommandline() before the slugify() sanitizer runs.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.