CVE-2026-73680: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Cockpit HQ Cockpit CMS
Cockpit CMS 2.14.0 and prior contains a command injection vulnerability in the FFmpeg integration that allows authenticated users with only the assets/upload permission to execute arbitrary commands by uploading a video file with a shell metacharacter-laden filename. The unsanitized filename is interpolated into a shell command executed via Process::fromShellCommandline() before the slugify() sanitizer runs, enabling injected shell metacharacters such as backticks, $(), and semicolons to escape the FFmpeg command context and execute as the web-server user.
AI Analysis
Technical Summary
CVE-2026-73680 is a command injection vulnerability in Cockpit CMS (<=2.14.0) within the FFmpeg integration. The flaw occurs because the filename of an uploaded video file is passed unsanitized into a shell command executed via Process::fromShellCommandline(). Although a slugify() sanitizer is applied, it runs after the shell command execution, allowing shell metacharacters such as backticks, $(), and semicolons to escape the intended FFmpeg command context. This enables authenticated users with only the assets/upload permission to execute arbitrary OS commands with the privileges of the web-server user.
Potential Impact
Successful exploitation allows an authenticated user with limited upload permissions to execute arbitrary OS commands on the server hosting Cockpit CMS. This can lead to full compromise of the web server, including data theft, service disruption, or further pivoting within the network. The CVSS 3.1 score of 8.8 reflects high confidentiality, integrity, and availability impacts.
Mitigation Recommendations
No explicit patch or remediation details are provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict upload permissions to trusted users only and consider additional input validation or sandboxing measures to mitigate risk.
CVE-2026-73680: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Cockpit HQ Cockpit CMS
Description
Cockpit CMS 2.14.0 and prior contains a command injection vulnerability in the FFmpeg integration that allows authenticated users with only the assets/upload permission to execute arbitrary commands by uploading a video file with a shell metacharacter-laden filename. The unsanitized filename is interpolated into a shell command executed via Process::fromShellCommandline() before the slugify() sanitizer runs, enabling injected shell metacharacters such as backticks, $(), and semicolons to escape the FFmpeg command context and execute as the web-server user.
CVSS v3.1
Score 8.8high
Affected software
Cockpit HQ
Cockpit CMS
pkg:github/cockpit-hq/CockpitRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-73680 is a command injection vulnerability in Cockpit CMS (<=2.14.0) within the FFmpeg integration. The flaw occurs because the filename of an uploaded video file is passed unsanitized into a shell command executed via Process::fromShellCommandline(). Although a slugify() sanitizer is applied, it runs after the shell command execution, allowing shell metacharacters such as backticks, $(), and semicolons to escape the intended FFmpeg command context. This enables authenticated users with only the assets/upload permission to execute arbitrary OS commands with the privileges of the web-server user.
Potential Impact
Successful exploitation allows an authenticated user with limited upload permissions to execute arbitrary OS commands on the server hosting Cockpit CMS. This can lead to full compromise of the web server, including data theft, service disruption, or further pivoting within the network. The CVSS 3.1 score of 8.8 reflects high confidentiality, integrity, and availability impacts.
Mitigation Recommendations
No explicit patch or remediation details are provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict upload permissions to trusted users only and consider additional input validation or sandboxing measures to mitigate risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-08-13T15:15:35.896Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a7f7683bf8831d539a4045e
Added to database: 08/14/2026, 20:11:47 UTC
Last enriched: 09/25/2026, 02:40:19 UTC
Last updated: 09/27/2026, 12:10:23 UTC
Views: 75
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.