CVE-2026-73680

Executive Summary

CVE-2026-73680 is an unauthenticated-signup-independent, authenticated command injection vulnerability in Cockpit CMS 2.14.0 and prior, located in the platform's FFmpeg video-processing integration. An attacker who holds only the low-privileged assets/upload permission can upload a video file whose filename contains shell metacharacters (backticks, $(), semicolons); the unsanitized filename is interpolated into a shell command executed via Process::fromShellCommandline() before the slugify() sanitizer runs, yielding arbitrary command execution as the web-server user. With a CVSS base score of 8.8 and no vendor patch currently available, every unhardened Cockpit CMS deployment that enables FFmpeg processing and exposes the asset upload feature to authenticated users is at immediate risk of full web-tier compromise.

Technical Analysis

The vulnerability class is CWE-78 (Improper Neutralization of Special Elements used in an OS Command), occurring at the boundary between application-controlled data and the operating system shell. Cockpit CMS 2.14.0's FFmpeg integration transforms uploaded video assets (e.g., transcoding, thumbnail extraction, metadata probing). The NVD description establishes the following execution sequence:

1. An authenticated user with only the assets/upload permission submits a video file as a multipart upload.
2. The filename component of that upload is accepted as-is and not normalized at the point of intake.
3. The raw filename is interpolated directly into a shell command string before any slugify() sanitization is applied.
4. The assembled string is passed to Process::fromShellCommandline(), which executes the entire string through a shell interpreter (e.g., /bin/sh).
5. Because the sanitizer (slugify()) runs after interpolation, shell metacharacters embedded in the filename — backticks, $() command substitution, and semicolons — survive into the executed command line. The attacker-controlled portion escapes the intended FFmpeg argument context and is evaluated as arbitrary commands by the shell.

The root cause is an ordering defect: sanitization is applied downstream of dangerous string interpolation. Even if slugify() is robust, it cannot repair a command line that has already been assembled with attacker-controlled metacharacters. The sink, Process::fromShellCommandline(), is a Symfony Process API method designed for shell-based execution; unlike array-based argument passing, it performs no quoting or escaping of user data. The FFmpeg binary itself is not the vulnerable component — the vulnerability is purely in how Cockpit CMS constructs and executes the wrapper command.

Attack surface: the Web UI asset-upload handler and any headless/API counterpart that accepts a filename parameter, reachable over the network (CVSS AV:N). Authentication is required, but only the most basic asset-management privilege (assets/upload) — no administrative role is needed. The resulting process runs with the privileges of the web-server user (typically www-data/nobody or the application service account), which in standard PHP-FPM/Apache/nginx deployments also owns the CMS codebase, configuration files, and writable content directories. The default vector is therefore a low-privileged authenticated user escalating to operating-system-level command execution.

No patch evidence exists from any tracked source, and the vendor has not yet published a fixed release. The affected version range is effectively all Cockpit CMS releases up to and including 2.14.0. Insufficient technical detail is available regarding the exact upload file-path or the precise naming of the FFmpeg wrapper component; the description above is limited strictly to the mechanism documented in the NVD entry.

Exploitation Scenarios

No public PoC or in-the-wild exploitation has been confirmed for CVE-2026-73680; the attack chain below is inferred from the vulnerability class and the specific conditions described in the NVD entry.

1. Reconnaissance and target identification. The attacker identifies internet-facing Cocktail CMS deployments — for example, via HTTP fingerprinting (title, HTML markers, or CMS-specific assets) or Shodan queries such as http.title:"Cockpit". The attacker confirms version 2.14.0 or earlier and determines whether the FFmpeg integration is active and whether asset upload is exposed to non-admin roles.

2. Low-privilege access acquisition. The attack requires a valid session with the assets/upload permission. An attacker may register for such access if self-registration is enabled, obtain credentials through phishing or credential stuffing, or compromise an existing low-privileged editor/asset-manager account. No administrative rights are required.

3. Payload delivery and command injection. The attacker crafts a video file (any format FFmpeg will accept — .mp4, .mov, .avi, etc.) whose filename embeds shell metacharacters, e.g., a filename resembling clip.mp4;id or using backtick/$() command-substitution syntax. The file is uploaded via the asset-upload interface. The application inserts the raw filename into the FFmpeg shell command; the injected metacharacters terminate the intended command context and cause the shell to evaluate the attacker's payload. Commands execute with the web-server user's privileges.

4. Post-exploitation. Depending on the web-server account's rights, the attacker can read the CMS configuration (databases credentials, API keys, secret salts), retrieve or modify uploaded content and user records, plant web shells or backdoors inside the document root, pivot to adjacent database or storage services, and use the compromised host as a beachhead for lateral movement into the hosting environment. Since integrity and availability are also compromised, the attacker can destroy or ransom site data and cripple the CMS's operational availability.

Ethical testing guidance: exploit verification should occur only in isolated lab environments with express authorization; the metacharacter payload classes are trivial to adapt, so defender timelines should assume weaponization is imminent even before a formal PoC is published.

Impact Assessment

• CVSS 3.1 Base Score: 8.8 (High) — Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
• Attack vector (AV:N): Remote, network-reachable; no physical or adjacent-network access required.
• Attack complexity (AC:L): No race conditions or special conditions; a well-formed filename is sufficient.
• Privileges required (PR:L): Only the assets/upload permission — a default capability for asset managers and many content editors; administrative rights are explicitly NOT required.
• User interaction (UI:N): No victim interaction needed; the upload action is attacker-driven.
• Scope (S:U): Impact is confined to the vulnerable component's security authority (the web-server process), though the CMS and its data fall inside that authority.
• CIA (C:H/I:H/A:H): Full confidentiality, integrity, and availability impact at the web-tier level.

Business impact: For a CMS, this is a complete-takeover scenario. Site content, user databases, and secrets can be exfiltrated; content can be tampered with (including supply-chain-style watering-hole injection into pages delivered to site visitors); and service availability can be destroyed. Organizations relying on Cockpit CMS headless APIs for downstream applications face cascading compromise of consuming systems.

Blast radius: Directly compromised assets include the web server process, the Cockpit codebase and configuration, uploaded media, and any data store the web-server account can access. Indirectly, the attacker may leverage the foothold to attack databases, CI/CD pipelines, adjacent application servers, and the hosting provider's internal network — particularly where the CMS runs with over-privileged service accounts or shared hosting credentials.

Exploitation likelihood: Elevated. The vulnerability requires only a basic upload permission, is trivially triggerable via the standard UI, and the exploited component (shell command construction) is well-understood. The absence of a patch makes this a permanent 0-day window for every exposed instance. Note: CISA KEV does not currently list this CVE, and EPSS has not yet scored it (no fabricated EPSS value is provided here).

Detection Guidance

The detection strategy below assumes the vulnerable server executes a shell that spawns ffmpeg (or a wrapper) with a command line containing the attacker-controlled filename. Endpoint-based rules key on the child process command line; network rules key on the multipart upload filename containing shell metacharacters. Tune the process-name filter to the actual binary path used by the CMS deployment (e.g., /usr/bin/ffmpeg versus vendored builds).

Sigma Rule

title: Cockpit CMS FFmpeg Command Injection - Shell Metacharacters in Process Command Line
id: 6f2b2c9e-4a1d-4f7e-9c03-8b71d4e2f5a1
status: experimental
description: Detects process creation events where an ffmpeg-related command line contains
    shell metacharacters commonly used to exploit CVE-2026-73680 (backticks, $(), semicolons,
    logical operators, or pipes). Based on NVD description for Cockpit CMS <= 2.14.0.
logsource:
    category: process_creation
    product: linux
detection:
    selection_ffmpeg:
        - Image|endswith:
              - '/ffmpeg'
              - '/avconv'
        - CommandLine|contains: 'ffmpeg'
    selection_metachars:
        CommandLine|contains:
            - '`'
            - '$('
            - ';'
            - '&&'
            - '||'
            - '|'
    condition: selection_ffmpeg and selection_metachars
falsepositives:
    - Legitimate ffmpeg invocations where input filenames legitimately contain semicolons
      (rare; review and tune when file naming policies are enforced).
level: high
tags:
    - attack.execution
    - attack.t1059
    - cve.2026.73680
    - cwe.78

# Variant for Windows-based deployments where ffmpeg is a child of php.exe:
title: Cockpit CMS FFmpeg Command Injection - Windows Process Creation
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: ['\php.exe', '\php-cgi.exe', '\cmd.exe']
    selection_cmd:
        CommandLine|contains:
            - 'ffmpeg'
            - 'avconv'
    selection_metachars:
        CommandLine|contains:
            - '`'
            - '$('
            - ';'
            - '&&'
            - '|'
    condition: selection_parent and selection_cmd and selection_metachars
level: high

YARA Rule

rule Cockpit_CMS_FFmpeg_CMD_Injection_Filenames
{
    meta:
        author = "Threat Intelligence - vaterlsit.com"
        description = "Detects uploaded media filenames containing shell metacharacters
                       consistent with CVE-2026-73680 command injection in Cockpit CMS <= 2.14.0"
        cve = "CVE-2026-73680"
        cwe = "CWE-78"
        date = "2026-02-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-73680"
    strings:
        $ext_video = /\.(mp4|mov|avi|mkv|webm|m4v|flv|mpeg|mpg)$/ nocase
        $meta_backtick = "`"
        $meta_dollar_paren = "$("
        $meta_semicolon = ";"
        $meta_andand = "&&"
        $meta_oror = "||"
        $meta_pipe = "|"
        $meta_redirect = ">"
    condition:
        $ext_video and 1 of ($meta_*) and filesize < 200KB
}

// Variant for scanning HTTP request bodies (upload filename Header) in network captures:
rule Cockpit_CMS_FFmpeg_Multipart_Filename_Injection
{
    meta:
        description = "Matches multipart/form-data filename parameters containing shell metacharacters"
        author = "vaterlsit.com Threat Intel"
    strings:
        $fn = "filename=" ascii nocase
        $bt = "`" ascii
        $dp = "$(" ascii
        $sc = ";" ascii
        $amp = "&&" ascii
        $pipe = "|" ascii
        $video = ".mp4" ascii nocase
    condition:
        $fn and $video and 1 of ($bt, $dp, $sc, $amp, $pipe)
}

Suricata IDS Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Cockpit CMS FFmpeg Command Injection via Multipart Filename (CVE-2026-73680)"; flow:established,to_server; http.method; content:"POST"; http.content_type; content:"multipart/form-data"; http.request_body; content:"filename=\""; http.request_body; nocase; content:"`"; http.request_body; http.request_body; within:512; sid:202673680; rev:1; metadata:created_at 2026_02_01, updated_at 2026_02_01, cve CVE-2026-73680, mitre_tactic_id TA0002, mitre_technique_id T1059;)

Rules for the $( and semicolon variants should mirror the same template, substituting the content clause (e.g., content:"$(") to avoid a single-rule bypass. When deploying on encrypted TLS services, pair with endpoint detection; the filename will be invisible to NIDS if the CMS serves over HTTPS.

Elastic Detection

// Elastic EQL - detect ffmpeg child processes with shell metacharacters in the command line
process where process.name in ("ffmpeg", "avconv") and
  process.command_line : "*ffmpeg*" and
  (
    process.command_line : "*`*" or
    process.command_line : "*$(*" or
    process.command_line : "*;*" or
    process.command_line : "*&&*" or
    process.command_line : "*||*"
  )

// Complementary rule for the parent shell process
process where event.action == "exec" and process.name in ("sh", "bash", "dash", "cmd.exe") and
  process.pe.original_file_name : ("sh", "bash", "dash", "cmd.exe") and
  (
    process.command_line : "*ffmpeg*" and
    process.command_line : ("*`*", "*$(*", "*;*", "*&&*", "*|*")
  )

Tune the process.name list to your environment's binaries; for cgroups/containers, filter on the container name to reduce noise from legitimate media pipelines.

Splunk SPL Query

index=* (sourcetype=ProcessRollup2* OR sourcetype=WinEventLog:Security OR sourcetype=linux_audit OR sourcetype=auditd)
| search (ProcessCommandLine="*ffmpeg*" OR CommandLine="*ffmpeg*")
| regex (ProcessCommandLine|CommandLine)="(?i)ffmpeg.*[`\$\(;&|]"
| eval ffmpeg_cmd = coalesce(ProcessCommandLine, CommandLine)
| table _time, host, user, ParentProcessID, ProcessID, ffmpeg_cmd, Image
| sort - _time

For high-volume environments, convert the regex into a lookup- or EDR-free pipeline that flags only events where the ffmpeg command line contains a video extension and a metacharacter before the first whitespace-separated argument, reducing false positives from innocuous filenames.

Wazuh OSSEC Rule

<group name="process_creation,execution,">
  <!-- Default parent/child rule IDs vary by platform; adjust <if_sid> to your
       Wazuh baseline (e.g., 571 for Windows CreateProcess, 80700 for Linux auditd). -->
  <rule id="100936" level="12">
    <if_sid>571,80700</if_sid>
    <match>ffmpeg|avconv</match>
    <regex>(?i).*ffmpeg.*[\x60\$\x28;&\|].*</regex>
    <description>Cockpit CMS ffmpeg command executed with shell metacharacters - possible CVE-2026-73680 exploitation</description>
    <group>ossec,cve,cwe-78,attack.execution,attack.t1059,</group>
    <mitre>
      <id>T1059</id>
    </mitre>
    <cve>CVE-2026-73680</cve>
    <options>no_full_log</options>
  </rule>
</group>

If your Wazuh deployment does not have rule 571/80700 active, adjust <if_sid> to your locally observed process-creation rule ID and test against a benign ffmpeg workload to baseline false positives.

Mitigation & Patch Guidance

Patch confidence is 0/4: no vendor advisory, no fixed version, no backport, and no workaround notice is available from any tracked source. CVE-2026-73680 is currently unpatched; assume all Cockpit CMS instances up to 2.14.0 are vulnerable.

1. Immediate mitigations (no patch exists):

• Disable the FFmpeg integration in the CMS configuration if video transcoding/thumbnail generation is not business-critical. This removes the vulnerable sink entirely.
• If FFmpeg processing must remain active, strip or sanitize filenames at the upload boundary — before persistence or processing — by rejecting uploads whose filename contains any of ` $( ; && || | or whitespace-shell metacharacters. Enforce an allowlist of [A-Za-z0-9._-] for filenames.
• Restrict the assets/upload permission to trusted roles only; audit existing user accounts and remove the capability from remote/untrusted contractors.
• Run the web-server process with a dedicated system account that has no write access to the CMS document root, database credentials file, or OS configuration files. Apply minimal sudo/capability grants.
• Place the CMS behind a WAF/reverse proxy with a rule that inspects multipart filename= parameters in POST bodies for shell metacharacters, and logs/blocks such requests.

2. Patch/upgrade steps:

• Monitor the Cockpit CMS repository and security advisory channel for a release newer than 2.14.0; when available, upgrade immediately and verify the fix includes moving FFmpeg execution to array-based argument passing (no shell) or reordering sanitization before interpolation.
• Until an official fix is released, apply the vendor's guidance if a private advisory or backport is announced.
• After upgrading, re-verify with a controlled test upload containing metacharacters in the filename to confirm the injection path is closed.

3. Long-term hardening:

• Eliminate all shell-based command construction for media processing; prefer direct process spawn APIs with argument arrays that do not invoke the shell (e.g., Process::fromArray()-style invocation), which neutralizes the entire CWE-78 class.
• Adopt containerization with read-only root FS and transient writable volumes; run FFmpeg workers as non-root with seccomp/AppArmor profiles denying shell exec of unknown binaries.
• Centralize logging of process creation (Windows Sysmon, Linux auditd) and alert on any process whose command line contains application data rather than static arguments.
• Treat the asset-upload feature as a risky attack surface: rate-limit uploads, add CSRF and filename-length limits, and require re-authentication for uploads from privileged contexts.

References

1. NVD Entry — CVE-2026-73680: https://nvd.nist.gov/vuln/detail/CVE-2026-73680
2. MITRE CWE-78 (Improper Neutralization of Special Elements used in an OS Command): https://cwe.mitre.org/data/definitions/78.html
3. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
4. MITRE ATT&CK T1059 — Command and Scripting Interpreter: https://attack.mitre.org/techniques/T1059/
5. CISA Known Exploited Vulnerabilities Catalog (CVE-2026-73680 is NOT currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No vendor advisory was available at the time of writing; no public PoC, Nuclei template, or exploit code was identified; no in-the-wild exploitation or threat-actor campaign has been attributed to CVE-2026-73680. Organizations should treat the unpatched, remotely triggerable command-injection window as a priority regardless of current KEV/EPSS status.