CVE-2026-72557: Cockpit CMS RCE Vulnerability

CVE-2026-72557 Overview

CVE-2026-72557 is an unrestricted file upload vulnerability in Cockpit CMS 2.6.0. The flaw resides in the asset upload endpoint, where the allowed_uploads configuration defaults to a wildcard (*). Any authenticated user can upload files with arbitrary extensions, including PHP scripts, to a web-accessible directory. An attacker with any valid account can drop a PHP webshell and execute arbitrary operating system commands on the underlying server. The weakness is categorized under CWE-434: Unrestricted Upload of File with Dangerous Type.

Critical Impact
Any authenticated Cockpit CMS 2.6.0 user can achieve remote code execution by uploading a PHP webshell through the asset endpoint, resulting in full server compromise.

Affected Products

Cockpit CMS 2.6.0
Deployments using the default allowed_uploads wildcard configuration
Instances where the asset upload directory is served by the web server

Discovery Timeline

2026-08-11 - CVE-2026-72557 published to the National Vulnerability Database (NVD)
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-72557

Vulnerability Analysis

Cockpit CMS exposes an asset upload endpoint intended for storing media and documents used by content editors. The endpoint validates file extensions against the allowed_uploads configuration value. In version 2.6.0, this value defaults to a wildcard character, which authorizes every extension including server-executable formats such as .php, .phtml, and .phar.

Uploaded assets are written to a directory reachable through the web server. Because no server-side transformation or content-type enforcement blocks executable payloads, a PHP interpreter processes any uploaded script when the URL is requested. The vulnerability lowers the barrier to remote code execution to a single authenticated request, regardless of the account's role.

Root Cause

The root cause is an insecure default configuration combined with missing extension and MIME allowlisting on the asset upload handler. The wildcard allowed_uploads value disables the intended safeguard, and the storage path lacks execution restrictions such as .htaccess rules or a Content-Disposition enforcement layer. This aligns with CWE-434, where user-supplied files are trusted without validation of type or content.

Attack Vector

An attacker first obtains any authenticated session, including a low-privilege editor account. The attacker then submits a multipart upload request to the asset endpoint containing a PHP file with webshell logic. After the server stores the file in the web-accessible asset directory, the attacker requests the file URL directly. The PHP interpreter executes the uploaded code, giving the attacker command execution under the web server user. From there, the attacker can pivot, read database credentials, and establish persistence. Additional technical context is available in the Cockpit HQ GitHub repository.

Detection Methods for CVE-2026-72557

Indicators of Compromise

New files with executable extensions such as .php, .phtml, .phar, or .pht inside the Cockpit storage/uploads/ or /assets/ directories
HTTP POST requests to the Cockpit asset upload endpoint followed by GET requests to the same file path within a short window
Web server process (www-data, nginx, apache) spawning shell binaries such as /bin/sh, bash, nc, or python
Outbound network connections initiated by the PHP-FPM or web server worker to unfamiliar external hosts

Detection Strategies

Monitor file creation events in Cockpit asset directories and alert on any non-media MIME types or scriptable extensions
Correlate authenticated Cockpit API upload events with subsequent direct requests to /storage/uploads/* paths
Baseline the process tree of the web server and flag child processes that deviate from expected PHP-CGI or PHP-FPM activity

Monitoring Recommendations

Enable web server access logging with full URI and referrer capture, then forward logs to a centralized analytics platform
Track authentication events in Cockpit and alert on account creation followed by immediate asset uploads
Review file integrity monitoring reports daily for unexpected additions to public asset paths

How to Mitigate CVE-2026-72557

Immediate Actions Required

Restrict the allowed_uploads configuration to an explicit allowlist of non-executable extensions such as jpg, png, pdf, and mp4
Audit all accounts in Cockpit CMS and disable or rotate credentials for accounts that are not actively required
Inspect the asset storage directory for unauthorized .php, .phtml, or .phar files and remove any confirmed webshells
Rotate application secrets, database credentials, and API tokens accessible to the web server user

Patch Information

At the time of publication, no vendor patch reference is included in the NVD entry. Administrators should monitor the Cockpit HQ GitHub repository for updated releases and security advisories, and upgrade beyond version 2.6.0 once a fixed build is available.

Workarounds

Set allowed_uploads to an explicit extension allowlist in the Cockpit configuration and remove the wildcard value
Configure the web server to deny execution of PHP within the asset storage directory using location rules in NGINX or <Directory> directives with php_admin_flag engine off in Apache
Place the Cockpit asset directory behind a reverse proxy path that serves files with a static Content-Type and disables script handlers
Restrict the asset upload endpoint to trusted roles by enforcing role-based access control at the application or reverse-proxy layer

bash

# Example NGINX configuration to block PHP execution in the Cockpit uploads directory
location ^~ /storage/uploads/ {
    location ~ \.(php|phtml|phar|pht)$ {
        deny all;
        return 403;
    }
    default_type application/octet-stream;
    add_header X-Content-Type-Options "nosniff";
}