Cockpit CMS contains an authenticated remote code execution vulnerability (CWE-94) in the /cockpit/collections/save_collection endpoint. Authenticated users with collection management privileges can inject arbitrary PHP code through collection rule parameters. The injected code is saved to server-side PHP files and executed using include(), allowing attackers to execute arbitrary commands on the underlying server. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high severity. No patch or official remediation level has been disclosed, and the product is not a cloud service, so remediation depends on vendor updates or user mitigation.

Successful exploitation allows an authenticated attacker with collection management privileges to execute arbitrary PHP code on the server hosting Cockpit CMS. This can lead to full compromise of the server, including confidentiality, integrity, and availability impacts. The vulnerability is high severity (CVSS 8.8) due to the potential for remote code execution and complete system control. There are no known public exploits currently reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict collection management privileges to trusted users only. Monitor for unusual activity related to collection rule modifications. Avoid exposing the Cockpit CMS management interface to untrusted networks. Follow vendor channels for updates on patches or official mitigations.