CVE-2026-38993

Cockpit 2.13.5 and earlier is vulnerable to directory traversal via the Buckets component

Medium · published April 29, 2026

CVSS v3.1
6.5
EPSS
1%
Percentile
61.2
In the wild
Unconfirmed
What it is

Cockpit 2.13.5 and earlier is vulnerable to directory traversal via the Buckets component. This vulnerability allows authenticated attackers to write files to arbitrary locations within the uploads directory or overwrite assets with malicious versions.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00960 · 61.2th percentile
Published
2026-04-29T00:00Z
EPSS history
Timeline
  • 29 APR 00:00Z
    Cockpit 2.13.5 and earlier is vulnerable to directory traversal via the Buckets component
    cvelistv5