Threats tagged 'ghsa-j2rx-4jg9-79mw'

Cockpit versions 2.13.5 and earlier contain a vulnerability in the Bucket component's file type validation, allowing authenticated users to upload files with dangerous extensions such as .php. This misconfiguration enables attackers to execute arbitrary code on the server by bypassing the extension filter through specially crafted filenames. The issue is fixed in version 2.14.0.