Versions of cockpit-hq/cockpit prior to 2.4.1 are vulnerable to an arbitrary file upload issue where an attacker can bypass the upload filter by using different file extensions. This allows an unauthenticated attacker to upload files that could potentially lead to further compromise. The vulnerability has a CVSS 4.0 score of 8.7, indicating high impact with network attack vector, no privileges or user interaction required, and high impact on integrity. No official patch or remediation level has been confirmed in the provided data.

An attacker can upload arbitrary files by bypassing the upload filter, potentially leading to unauthorized code execution or system compromise. The vulnerability does not require privileges or user interaction, increasing its risk. However, no known exploits in the wild have been reported as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict file upload functionality, implement strict server-side validation, and monitor for suspicious upload activity. Avoid relying solely on client-side or extension-based filtering.