CVE-2026-34965 Details
Description
Cockpit CMS contains an authenticated remote code execution vulnerability in the /cockpit/collections/save_collection endpoint that allows authenticated attackers with collection management privileges to inject arbitrary PHP code into collection rules parameters. Attackers can inject malicious PHP code through rule parameters which is written directly to server-side PHP files and executed via include() to achieve arbitrary command execution on the underlying server.
A remote code execution vulnerability has been identified in Cockpit CMS versions through commit 494765e. This vulnerability exists in the '/cockpit/collections/save_collection' endpoint, allowing authenticated attackers with collection management privileges to inject arbitrary PHP code into collection rules parameters. The injected code is written directly to server-side PHP files and executed via the 'include()' function, enabling arbitrary command execution on the underlying server.
Remove the functionality that allows user input to be written as PHP code and executed. Instead, store rules as data in a JSON format and implement strict validation to reject PHP tags or any executable code.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 29, 2026CISA-ADP
Assessed May 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gist.github.com/thepiyushkumarshukla/64d2318518b17f529bc3ccb11fd5be90 | [email protected] | ExploitTechnical Analysis |
| https://github.com/agentejo/cockpit | [email protected] | ProductSource CodeVendor |
| https://github.com/agentejo/cockpit/commits/494765e4f0fb9484f320aee0c6ee889b6fa789b9 | [email protected] | Source CodeVendor |
| https://www.vulncheck.com/advisories/cockpit-cms-authenticated-remote-code-execution-via-collections | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Agentejo Cockpit CMS | <= commit 494765e |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | New CVE Received | [email protected] |