CVE-2026-72557

Name of the Vulnerable Software and Affected Versions Cockpit CMS version 2.6.0

Description An unrestricted file upload issue allows authenticated users to upload files with any extension, including PHP scripts, through the asset upload endpoint. This occurs because the allowed uploads configuration defaults to a wildcard (*), and the uploaded files are stored in a directory accessible via the web. An attacker with any authenticated account can upload a PHP webshell to execute arbitrary operating system commands on the server.

Recommendations Update Cockpit CMS version 2.6.0 to a newer version that restricts file upload extensions. Restrict the allowed uploads configuration to only permit safe file extensions instead of using a wildcard.