A critical vulnerability in Cockpit CMS allows authenticated attackers to execute arbitrary code by bypassing file extension filters in the Bucket component.

The vulnerability resides in the Bucket component's _isFileTypeAllowed function, which fails to correctly validate filenames. An authenticated attacker can rename files to use a .php extension, leading to remote code execution on the underlying server.

This vulnerability poses a significant risk to the integrity and availability of the host server. With a CVSS score of 8.8, it represents a high-severity flaw that allows an attacker to gain full control over the application environment. Successful exploitation could lead to total system compromise, unauthorized data access, and potential lateral movement within the network.

Immediate Action: Update Cockpit CMS to version 2.14.0 or later as provided by the vendor.

Proactive Monitoring: Review web server access logs for requests targeting the Bucket component or suspicious file renaming activity. Monitor for unexpected .php file creation in directory paths managed by the CMS.

Compensating Controls: Implement strict file upload policies and utilize a Web Application Firewall (WAF) to block requests containing malicious file extensions or suspicious patterns directed at the Bucket endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists via the Felsec technical write-up referenced by the CVE record.

Given the potential for remote code execution and the availability of a public proof-of-concept, administrators should prioritize updating to Cockpit CMS 2.14.0 immediately. Organizations that cannot update should restrict access to the administrative interface or disable the affected Bucket component until a patch is applied.