PT-2025-4135 · Cockpit Hq · Cockpit

Choocs · Published 2023-03-17 · Updated 2025-02-10 · CVE-2025-1025

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions cockpit-hq/cockpit versions prior to 2.4.1

Description The issue allows for Arbitrary File Upload, where an attacker can bypass the upload filter by using different extensions.

Recommendations For cockpit-hq/cockpit versions prior to 2.4.1, consider restricting file uploads or implementing additional validation to prevent bypassing the upload filter until a patch is available.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

BDU:2026-00069

CVE-2025-1025

GHSA-WP68-XRFG-XVQ4

Affected Products

Cockpit

References · 16

• 🔥 https://gist.github.com/CHOOCS/fe1227443544d5d74c33982814f290af · Exploit
• https://osv.dev/vulnerability/GHSA-wp68-xrfg-xvq4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-1025 · Security Note
• https://osv.dev/vulnerability/CVE-2025-1025 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-00069 · Security Note
• https://github.com/Cockpit-HQ/Cockpit · Note
• https://github.com/Cockpit-HQ/Cockpit/releases/tag/2.4.1 · Note
• https://github.com/Cockpit-HQ/Cockpit/commit/984ef9ad270357b843af63c81db95178eae42cae · Note
• https://github.com/Cockpit-HQ/Cockpit/commit/becca806c7071ecc732521bb5ad0bb9c64299592 · Note
• https://securitycode.ru/company/blog/daydzhest-laboratorii-analiza-setevykh-ugroz-kod-bezopasnosti-za-mart-2025 · Note
• https://security.snyk.io/vuln/SNYK-PHP-COCKPITHQCOCKPIT-8516320 · Note
• https://t.me/cvenotify/110176 · Telegram Post
• https://t.me/latest_high_impact_cve/1795 · Telegram Post
• https://t.me/cvedetector/17274 · Telegram Post
• https://twitter.com/CVEnew/status/1887011596699926726 · Twitter Post