CVE-2026-38993 is a directory traversal vulnerability affecting Cockpit versions up to and including 2.13.5. The issue resides in the Buckets component, allowing authenticated attackers to write files outside intended directories within the uploads folder or overwrite existing assets with malicious versions. This can compromise the integrity of the application by replacing legitimate files. The vulnerability requires low attack complexity and no user interaction but does require authentication privileges. The CVSS v3.1 base score is 6.5 (medium severity), reflecting no confidentiality or availability impact but high integrity impact. The Red Hat advisory linked does not specify an official fix or patch status.

An authenticated attacker can exploit this vulnerability to write or overwrite files within the uploads directory of Cockpit, potentially replacing legitimate assets with malicious ones. This compromises the integrity of the system and could lead to further exploitation depending on the overwritten files. There is no direct confidentiality or availability impact reported.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-38993 for current remediation guidance. Until a fix is available, restrict access to authenticated users and monitor for suspicious file modifications within the uploads directory. Avoid deploying vulnerable versions in untrusted environments.