PT-2026-36004 · Cockpit · Cockpit Cms

Published 2026-04-29 · Updated 2026-04-29 · CVE-2026-34965

Mitre

CVSS v3.1

8.8

High

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Cockpit CMS contains an authenticated remote code execution vulnerability in the /cockpit/collections/save collection endpoint that allows authenticated attackers with collection management privileges to inject arbitrary PHP code into collection rules parameters. Attackers can inject malicious PHP code through rule parameters which is written directly to server-side PHP files and executed via include() to achieve arbitrary command execution on the underlying server.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-34965

Affected Products

Cockpit Cms

References · 5

• 🔥 https://gist.github.com/thepiyushkumarshukla/64d2318518b17f529bc3ccb11fd5be90 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-34965 · Security Note
• https://github.com/agentejo/cockpit · Note
• https://github.com/agentejo/cockpit/commits/494765e4f0fb9484f320aee0c6ee889b6fa789b9 · Note
• https://vulncheck.com/advisories/cockpit-cms-authenticated-remote-code-execution-via-collections · Note