GHSA-38vf-35cg-m73w

Cockpit CMS arbitrary file upload vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-41564

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	cockpit-hq/cockpit	<= 2.6.3	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

An arbitrary file upload vulnerability in the Upload Asset function of Cockpit CMS v2.6.3 allows attackers to execute arbitrary code via uploading a crafted `.shtml` file.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-41564 advisory
https://github.com/Cockpit-HQ/Cockpit package
https://github.com/LongHair00/Mitre_opensource_report/blob/main/CockpitCMS-StoredXSS.md web