PT-2026-41318 · Unknown · Cockpit Cms

D6Fault + 1 · CVE-2026-23695 · Published 2026-05-15 · Updated 2026-05-15

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cockpit CMS versions prior to 2.14.1

Description A stored cross-site scripting issue exists in the Set field type's Display template option. The template string is processed by the $interpolate() function using new Function() and rendered via Vue's v-html directive without proper sanitization. An attacker with content/:models/manage permission can inject arbitrary JavaScript into the Display template, which then executes in the browser of any user viewing the collection items list.

Recommendations Update to the version containing commit 72a83fc.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-23695

GHSA-CH4J-VCF5-58X5

Affected Products

Cockpit Cms

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23695.json · Exploit
• https://github.com/Cockpit-HQ/Cockpit/commit/72a83fcfe85ad8330e9ae834bc02fa517b5749e9 · Patch
• https://osv.dev/vulnerability/GHSA-ch4j-vcf5-58x5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23695 · Security Note
• https://osv.dev/vulnerability/CVE-2026-23695 · Vendor Advisory
• https://github.com/Cockpit-HQ/Cockpit · Note
• https://vulncheck.com/advisories/cockpit-cms-stored-xss-via-set-field-display-template · Note