CVE-2026-38993

MEDIUM 6.5

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

Cockpit 2.13.5 and earlier is vulnerable to directory traversal via the Buckets component. This vulnerability allows authenticated attackers to write files to arbitrary locations within the uploads directory or overwrite assets with malicious versions.

Vendor	n/a
Product	n/a
Published	Apr 29, 2026
Last Updated	Jul 15, 2026

Stay Ahead of the Next One

Get instant alerts for n/a n/a

Be the first to know when new medium vulnerabilities affecting n/a n/a are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

n/a / n/a

n/a

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/Cockpit-HQ/Cockpit/releases/tag/2.14.0 felsec.com: https://felsec.com/posts/cockpit-cms-2.13.5-multi-vulns/ access.redhat.com: https://access.redhat.com/security/cve/CVE-2026-38993 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2463843 security.access.redhat.com: https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-38993.json