CVE-2026-38993 describes a directory traversal vulnerability (CWE-22) in Cockpit 2.13.5 and earlier versions within the Buckets component. The flaw allows authenticated users to write files outside intended directories, specifically enabling arbitrary file writes within the uploads directory or overwriting assets. The vulnerability has a CVSS 3.1 base score of 6.5 with an attack vector of network, low attack complexity, requiring privileges, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. No patch or official remediation level is currently documented.

The vulnerability allows authenticated attackers to compromise the integrity of the system by writing or overwriting files in arbitrary locations within the uploads directory. This could lead to malicious code execution or defacement if critical assets are overwritten. There is no reported impact on confidentiality or availability. No known exploits have been observed in the wild to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Buckets component to trusted users only and monitor for suspicious file modifications within the uploads directory. Avoid exposing the vulnerable versions in untrusted environments.