An authenticated remote code execution vulnerability in Cockpit CMS allows attackers with collection management privileges to execute arbitrary PHP code on the underlying server.

This is a code injection vulnerability (CWE-94) located in the /cockpit/collections/save_collection endpoint. An authenticated attacker with collection management permissions can inject malicious PHP code via the rules parameter, which the application subsequently writes to a file and executes via an include statement.

The vulnerability poses a severe risk to organizational security, as it allows for full system compromise, data theft, and unauthorized persistence on the host server. With a CVSS score of 8.8, this flaw is categorized as High, reflecting the potential for complete loss of confidentiality, integrity, and availability of the affected system. Successful exploitation could lead to total control over the server environment.

Immediate Action: Restrict access to the administrative and collection management interfaces to trusted users only, as this vulnerability requires authenticated access. Monitor vendor communications for the release of an official security patch and apply it immediately upon availability.

Proactive Monitoring: Review web server and application logs for suspicious POST requests targeting the /cockpit/collections/save_collection endpoint. Specifically, monitor for requests containing PHP syntax or unexpected file modifications within the storage/collections/rules directory.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block malicious payloads containing PHP code patterns in JSON-encoded POST requests. Ensure the application process runs with the least privilege necessary to limit the impact if code execution occurs.

Public Exploit Available: Yes — a public proof-of-concept exists as documented in the provided researcher write-up.

Given the ability to achieve remote code execution through the application's built-in functionality, the risk to infrastructure is significant. Organizations should immediately audit user permissions to ensure only necessary personnel have collection management rights and monitor for any anomalous activity. Prioritize patching as soon as the vendor provides a fix to eliminate the underlying code injection flaw.