CVE-2026-38991

Executive Summary

CVE-2026-38991 is a high-severity arbitrary file upload and code execution vulnerability affecting Cockpit CMS versions 2.13.5 and earlier. The flaw resides in the _isFileTypeAllowed function within the Bucket component, where a specially crafted filename can bypass the extension-based allowlist filter. An authenticated attacker with access to file management features can exploit this misconfiguration to rename arbitrary existing files to contain a .php extension, leading to arbitrary code execution on the underlying web server. Given a CVSS score of 8.8, this vulnerability poses a critical risk to the confidentiality, integrity, and availability of affected systems, and requires immediate attention from enterprises running exposed Cockpit instances.

Technical Analysis

The vulnerability is rooted in the Bucket component of Cockpit CMS, which handles file assets such as images, documents, and media within content collections. The _isFileTypeAllowed method is designed to enforce a server-side extension whitelist by splitting the provided filename and evaluating its final extension against a list of permitted types (e.g., .jpg, .png, .gif). However, a logical flaw lies in the filename parsing mechanism. The function does not robustly handle edge cases involving multiple dots, URL-encoded characters, null bytes, or trailing whitespace. Specifically, the filter evaluates only the substring after the last dot, but fails to validate the actual filename string that is later passed to the filesystem rename operation.

An attacker can craft a filename such as shell.php. (trailing dot), shell.php%00.png, or shell.php/.jpg to pass the extension check because the function sees .png or .jpg as the final extension, yet the underlying operating system or the application's file-handling routine may interpret the name differently after URI-decoding or normalization. In many Linux environments, a trailing dot is stripped by the filesystem, resulting in a file named shell.php. Similarly, a null-byte injection (%00) can terminate the string when passed to certain PHP filesystem functions, effectively truncating the filename to shell.php.

The attack surface is the authenticated web interface, specifically the file upload and media management endpoints under /api/files or /api/buckets. Although the attacker must be authenticated, the privileges required are low (a content editor or author role), and the component is often exposed to internet-facing applications to allow content managers to upload assets. Once the crafted filename bypasses the filter, the attacker can use the rename functionality to overwrite an existing file (e.g., an uploaded benign PNG) with a PHP payload, which is then executed server-side upon HTTP request.

Exploitation Scenarios

A determined attacker would chain the following steps to achieve remote code execution on a vulnerable Cockpit CMS instance:

1. Reconnaissance/Target Identification: The attacker scans the internet or internal network for Cockpit CMS installations using HTTP fingerprinting. Shodan queries such as http.title:"Cockpit" or detecting the X-Powered-By header reveal candidate targets. The attacker then probes the login page (/auth/login) to confirm the CMS version and identify whether default or weak credentials are in use.

2. Authentication and Access: The attacker authenticates using a valid low-privileged account (e.g., obtained via credential stuffing, phishing, or default credentials) that has permissions to access the content/media manager. They navigate to the Bucket file upload interface, typically located at /buckets in the admin backend.

3. Weaponization of the Filename: The attacker prepares a PHP web shell payload (e.g., <?php system($_GET['cmd']); ?>). When uploading, they manipulate the filename to shell.php%00.jpg. The _isFileTypeAllowed function splits on the last dot, sees .jpg as the extension, and permits the upload. However, when the application subsequently stores or renames the file using the provided name, the null byte in a PHP-context filesystem call causes the string to terminate, creating a file named shell.php on disk.

4. Trigger and Execution: The attacker accesses the uploaded file at a predictable web-accessible path, such as https://target.example.com/storage/uploads/shell.php?cmd=cat+/etc/passwd. The server executes the PHP code, returning the output of the injected command. The attacker can now issue arbitrary system commands, establish a reverse shell, or install a persistent backdoor.

5. Post-Exploitation: With command execution, the attacker escalates privileges by exploiting local kernel vulnerabilities, retrieves sensitive configuration files (e.g., database credentials from config/config.php), moves laterally across the internal network, and exfiltrates data. The compromised server may also be used as a pivot point for further attacks against adjacent systems.

Impact Assessment

The CVSS base score of 8.8 (High) reflects the potential for significant damage, driven by a network-exploitable attack vector (AV:N), low attack complexity (AC:L), and low privilege requirements (PR:L). The user interaction requirement is none (UI:N), and the scope is unchanged (S:U). The impact on confidentiality, integrity, and availability is rated high (C:H/I:H/A:H), meaning a successful exploit results in complete system compromise: full data exposure, file modification, and service disruption.

For enterprises, the blast radius is substantial. Cockpit CMS is used to build and manage corporate websites and internal web applications. A single compromised instance can reveal structured content, internal business data, and potentially the underlying database. Because the flaw is in a shared storage component (Bucket), all assets managed across the CMS—including those created by other users—may be tampered with. In a multi-tenant deployment or infrastructure as code, the compromise could propagate if the web server shares credentials or network access with other systems. The low EPSS score (0.00375) suggests in-the-wild exploitation is not yet widespread, but this is likely due to the CVE being recent; attacker adoption is expected to increase as technical analysis spreads.

Detection Guidance

Sigma Rule

title: Cockpit CMS - Suspicious Rename to PHP Extension
id: 8e3b2a1f-9c4d-4e6a-8f2b-1a9d3e5f7a0b
status: experimental
description: Detects attempts to rename or upload files with a .php extension via the Bucket component in Cockpit CMS, indicating a potential bypass of the extension filter (CVE-2026-38991).
logsource:
    category: web_server
    product: apache
    definition: 'Requires access logs for the Cockpit CMS application'
detection:
    selection_upload:
        cs-method: POST
        cs-uri-query|contains:
            - 'api/files'
            - 'api/buckets'
        cs-uri-query|re:
            - '(upload|rename)'
    selection_payload:
        cs-uri-query|re:
            - 'name=.*\.php'
            - 'filename=.*\.php'
    condition: selection_upload and selection_payload
falsepositives:
    - Legitimate admin actions renaming files to PHP for testing
    - Automated CMS updates
level: high

YARA Rule

rule Cockpit_CMS_Extension_Bypass_PHP
{
    meta:
        author = "ValterSIT Threat Intel"
        description = "Detects PHP filenames crafted to bypass Cockpit CMS Bucket extension filter (CVE-2026-38991)"
        reference = "CVE-2026-38991"
        date = "2025-05-01"
        severity = "high"
    strings:
        $ren = /(\/api\/(files|buckets).*(rename|upload))/ nocase
        $php_extension = "\.php" nocase
        $null_byte = "%00" nocase
    condition:
        $ren and $php_extension and (any of them)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-38991 - Cockpit CMS Bucket File Extension Bypass Attempt"; flow:established,to_server; content:"POST"; http_method; content:"/api/files|/api/buckets"; http_uri; content:"rename|upload"; http_uri; pcre:"/(filename|name)=[^\&\r\n]*\.php(\.|%00)/i"; sid:10038991; rev:1; metadata:affected_product "Cockpit_CMS", attack_target "Web_Server", cve "CVE-2026-38991";)

Elastic Detection

sequence by source.ip with maxspan=5m
  [network where event.action == "connection_accepted" and destination.port == 80 and process.name == "apache2"]
  [http where request.method == "POST" and request.uri matches "/api/(files|buckets)_.*(rename|upload).*" and url.query matches ".*(filename|name)=.*\.php(\.|%00).*"]
  [process where event.type == "start" and process.name in ("php", "php-fpm", "sh")]

Splunk SPL Query

index=web sourcetype=access_combined
| where method="POST" AND (uri LIKE "/api/files%rename%" OR uri LIKE "/api/buckets%rename%" OR uri LIKE "/api/files%upload%" OR uri LIKE "/api/buckets%upload%")
| rex field=uri "(?i)(filename|name)=(?<target_filename>[^\&\r\n]*)"
| where match(target_filename, "(?i)\.php(\.|%00)")
| eval severity="high"
| table _time, src_ip, method, uri, target_filename, status

Wazuh OSSEC Rule

<group name="cockpit_cms,">
  <rule id="389911" level="12">
    <decoded>POST /api/</decoded>
    <match>rename</match>
    <match>upload</match>
    <regex>(?i)(\.php(\.|%00))</regex>
    <description>Cockpit CMS Bucket extension bypass attempt (CVE-2026-38991)</description>
    <group>web_application_attack,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed).

1. Immediate Mitigations (Compensating Controls):

   • Restrict network access to the Cockpit CMS administrative interface. Implement strict firewall rules or an allowlist so that only trusted IP ranges (e.g., corporate VPN, office IPs) can reach the /api and /auth endpoints.
   • Enforce multi-factor authentication (MFA) for all CMS user accounts, especially those with content editing and file upload permissions.
   • If possible, disable the Bucket component's rename functionality temporarily via configuration, or remove upload/write permissions for low-privileged roles until patching is complete.
   • Run the web server with a dedicated low-privileged system account and enable a read-only filesystem where feasible.

2. Patch/Upgrade Steps:

   • Upgrade Cockpit CMS to version 2.13.6 or later as soon as the patch is obtained from the official vendor repository or package manager. Verify the integrity of the update using SHA-256 checksums.
   • If the vendor has not yet released an official advisory, contact the Cockpit CMS maintenance team for a hotfix or commit reference; the OSV source claims the fix exists.
   • After patching, revert the apply the configuration changes made in the immediate mitigation phase, carefully testing the Bucket component's functionality.

3. Long-Term Hardening:

   • Segment the web server hosting Cockpit from the internal network using a DMZ or micro-segmentation architecture, limiting lateral movement opportunities.
   • Implement a Web Application Firewall (WAF) with rules to block filenames containing .php followed by non-standard characters (e.g., %00, trailing dots) in multipart form data.
   • Regularly audit server access logs for anomalous file operations, particularly the rename or upload patterns described in the detection guidance.
   • Subscribe to security advisories from the Cockpit CMS project (https://getcockpit.com/security and the GitHub repository) and integrate CVE feed monitoring into your vulnerability management program to prioritize this and related future findings.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-38991 — Official CVE details, CVSS score, and vulnerability description.
2. OSV Advisory: https://osv.dev/vulnerability/CVE-2026-38991 — Open Source Vulnerability database entry referencing a claimed patch in the fix commit.
3. Cockpit CMS Official Website: https://getcockpit.com/ — Vendor site for official releases, security advisories, and download links for patched versions.
4. CWE-434 Unrestricted Upload of File with Dangerous Type: https://cwe.mitre.org/data/definitions/434.html — Common Weakness Enumeration reference for this vulnerability class.
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — While this CVE is NOT currently listed (KEV: NO), this resource should be monitored for updates, as in-the-wild exploitation status may change.

Threat Actor Activity: As of this report, there is no confirmed evidence of exploitation in the wild or association with known threat actor campaigns. The EPSS score of 0.00375 (30.3rd percentile) indicates low current exploitation probability, but the vulnerability is likely to attract attention from automated attacks given the simple exploitation vector and high impact.