What is GHSA-p46p-7pmj-m34f?

GHSA-p46p-7pmj-m34f is a security advisory published by GitHub Security Advisories with Medium severity. Cockpit is vulnerable to directory traversal

Which CVE IDs does GHSA-p46p-7pmj-m34f cover?

GHSA-p46p-7pmj-m34f covers the following CVE IDs: CVE-2026-38993. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-p46p-7pmj-m34f?

GHSA-p46p-7pmj-m34f has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

Which products are affected by GHSA-p46p-7pmj-m34f?

GHSA-p46p-7pmj-m34f affects 1 product, including: composer/cockpit-hq/cockpit:\u003c 2.14.0.

GHSA-p46p-7pmj-m34fMediumCVSS 6.5

Cockpit is vulnerable to directory traversal

Vendor

GitHub Security Advisories

Published

April 29, 2026

Last Modified

May 6, 2026

🔗 CVE IDs covered (1)

CVE-2026-38993 →

📋 Description

Cockpit 2.13.5 and earlier is vulnerable to directory traversal via the Buckets component. This vulnerability allows authenticated attackers to write files to arbitrary locations within the uploads directory or overwrite assets with malicious versions.

🎯 Affected products1

composer/cockpit-hq/cockpit:< 2.14.0

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-38993
https://felsec.com/posts/cockpit-cms-2.13.5-multi-vulns
https://github.com/Cockpit-HQ/Cockpit/releases/tag/2.14.0
https://github.com/advisories/GHSA-p46p-7pmj-m34f