An unrestricted file upload flaw in Cockpit CMS versions 0 through 2.6.0 enables authenticated attackers to execute arbitrary commands on the host server.

This is an unrestricted file upload vulnerability (CWE-434) where the asset upload endpoint fails to validate file extensions. An authenticated attacker can upload a PHP webshell to a web-accessible directory, resulting in arbitrary OS command execution.

Successful exploitation of this vulnerability allows an attacker to gain full control over the web server, leading to potential data exfiltration, system compromise, and lateral movement within the network. Given the CVSS score of 8.8, this represents a high-severity risk that could cause significant operational downtime and loss of data integrity.

Immediate Action: Review the official Cockpit CMS repository for the latest security patches and apply them to all affected instances immediately.

Proactive Monitoring: Inspect web server access logs for requests to suspicious file extensions or unexpected POST requests to asset upload endpoints.

Compensating Controls: Implement strict file type filtering at the Web Application Firewall (WAF) level and ensure the web server configuration prevents the execution of scripts within the asset storage directory.

Public Exploit Available: No

This vulnerability presents a severe risk to infrastructure integrity. Administrators should prioritize identifying all instances of Cockpit CMS and applying the necessary security updates as soon as they are made available by the vendor to prevent potential remote code execution.