Cockpit CMS contains an authenticated remote code execution vulnerability (CWE-94) in the /cockpit/collections/save_collection endpoint. Authenticated users with collection management privileges can inject arbitrary PHP code through collection rule parameters. The injected code is saved directly to server-side PHP files and executed via include(), resulting in arbitrary command execution on the underlying server. The CVSS 3.1 base score is 8.8, reflecting high impact on confidentiality, integrity, and availability. No patch or official remediation level has been published by the vendor as of the vulnerability disclosure date.

Successful exploitation allows an authenticated user with collection management privileges to execute arbitrary PHP code on the server hosting Cockpit CMS. This can lead to full compromise of the server, including unauthorized access, data theft, and disruption of service. The vulnerability impacts confidentiality, integrity, and availability with a high severity rating (CVSS 8.8). No known public exploits have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict collection management privileges to trusted users only and monitor for suspicious activity related to collection rule modifications. Avoid exposing the management interface to untrusted networks. Follow vendor updates closely for any forthcoming patches or mitigations.