Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Cockpit 2.13.5 and earlier is affected by a misconfiguration within the Bucket component _isFileTypeAllowed function where a specially crafted filename bypasses an extension filter. This allows an authenticated attacker to rename arbitrary files with the .php file extension enabling arbitrary code to be executed on the underlying server.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-38991 Arbitrary File Rename and PHP Code Execution in Cockpit 2.13.5 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-38991
Post summary
CVE-2026-38991 is disclosed as a file rename and PHP code execution vulnerability in Cockpit 2.13.5, with no evidence yet of PoC, exploitation, or patches cited.
🚨*CVE* CVE-2026-38991 Cockpit 2.13.5 and earlier is affected by a misconfiguration within the Bucket component _isFileTypeAllowed function where a specially crafted filename bypasses an ex… https://www.cve.org/CVERecord?id=CVE-2026-38991 ----- Traducción: CVE-2026-38991 Coc… http://infoflow.cloud`
Post summary
The post reports CVE-2026-38991 affecting Cockpit 2.13.5 and earlier, describing a misconfiguration that allows filename bypass via the _isFileTypeAllowed function.
CVE-2026-38991 Cockpit 2.13.5 and earlier is affected by a misconfiguration within the Bucket component _isFileTypeAllowed function where a specially crafted filename bypasses an ex… https://www.cve.org/CVERecord?id=CVE-2026-38991
Post summary
The text outlines a misconfiguration in Cockpit's Bucket component that permits filename exploits, but provides no evidence of active exploitation, patches, or PoC code.