Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.7
CVE-2026-73680: Cockpit CMS Authenticated Command Injection via Video File
CVE-2026-73680 · published 20 days ago
Summary
Cockpit CMS versions 2.14.0 and earlier have a security flaw in their video processing feature. An attacker with permission to upload files can exploit this flaw to execute unauthorized system commands. To protect your site, update to the latest version of Cockpit CMS as soon as possible.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| cockpit hq | cockpit cms | <= 2.14.0 |
Original advisory text
Cockpit CMS 2.14.0 Authenticated Command Injection via FFmpeg Filename
Cockpit CMS 2.14.0 and prior contains a command injection vulnerability in the FFmpeg integration that allows authenticated users with only the assets/upload permission to execute arbitrary commands by uploading a video file with a shell metacharacter-laden filename. The unsanitized filename is interpolated into a shell command executed via Process::fromShellCommandline() before the slugify() sanitizer runs, enabling injected shell metacharacters such as backticks, $(), and semicolons to escape the FFmpeg command context and execute as the web-server user.
Severity
8.7
High
CVSS 3.1: 8.8 (NVD)
CVSS 4.0: 8.7 (NVD)
Exploitation
EPSS 1%
Type
CWE-78OS Command Injection
Timeline
Published14 Aug 2026
Updated30 Aug 2026
First seen14 Aug 2026
Monitor software like this
Free during beta