CVE-2026-73680

Name of the Vulnerable Software and Affected Versions Cockpit CMS versions prior to 2.14.1

Description An issue in the FFmpeg integration allows authenticated users with assets/upload permissions to execute arbitrary commands. This occurs when a video file is uploaded with a filename containing shell metacharacters, such as backticks, $(), or semicolons. The unsanitized filename is processed by the Process::fromShellCommandline() function before the slugify() sanitizer is applied, allowing the metacharacters to escape the FFmpeg command context and execute commands as the web-server user.

Recommendations Update to a version newer than 2.14.0. Restrict the use of the assets/upload permission for untrusted users until the system is updated.