CVE-2025-1025CWE-434

Versions of the package cockpit-hq/cockpit before 2.4.1 are vulnerable to Arbitrary File Upload where an attacker can use different extension to bypass the…

High · published February 5, 2025

CVSS v4.0

8.7

EPSS

19%

Percentile

97.3

In the wild

Unconfirmed

What it is

Versions of the package cockpit-hq/cockpit before 2.4.1 are vulnerable to Arbitrary File Upload where an attacker can use different extension to bypass the upload filter.

The record

Technical detail

CVSS v4.0: 8.7 · HIGH
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P
EPSS: 0.18851 · 97.3th percentile
Weakness: CWE-434 · Unrestricted Upload of File with Dangerous Type
Published: 2025-02-05T05:00Z

EPSS history

Timeline

05 FEB 05:00Z
Versions of the package cockpit-hq/cockpit before 2.4.1 are vulnerable to Arbitrary File Upload where an attacker can use different extension to bypass the…
cvelistv5