Description

Cockpit CMS 2.14.0 and prior contains a command injection vulnerability in the FFmpeg integration that allows authenticated users with only the assets/upload permission to execute arbitrary commands by uploading a video file with a shell metacharacter-laden filename. The unsanitized filename is interpolated into a shell command executed via Process::fromShellCommandline() before the slugify() sanitizer runs, enabling injected shell metacharacters such as backticks, $(), and semicolons to escape the FFmpeg command context and execute as the web-server user.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-14T20:16:58.080Z",
  "pubdate": "2026-08-14T20:16:58.080Z",
  "executiveSummary": "Cockpit CMS versions 2.14.0 and prior suffer from an authenticated command injection vulnerability within the FFmpeg integration. This security flaw enables authenticated users possessing solely the assets/upload permission to execute arbitrary system commands on the underlying host operating system. The vulnerability arises due to improper input sanitization, where user-supplied filenames containing shell metacharacters are directly interpolated into a system process execution function before standard sanitization routines can be applied. Successful exploitation grants an attacker the ability to execute arbitrary commands within the security context of the web-server user, potentially leading to complete system compromise, unauthorized data access, or lateral movement within the network infrastructure. The exploitation vector requires valid user authentication with asset upload capabilities, limiting purely unauthenticated exploitation but posing a significant risk in multi-user environments where untrusted users hold media upload privileges.",
  "technicalDetails": "The vulnerability resides in the FFmpeg integration component of Cockpit CMS versions 2.14.0 and prior, specifically within the handling of uploaded video files. The root cause is an improper input validation and sanitization flaw where the filename of an uploaded asset is unsafely interpolated into a system shell command string. This execution is handled via the Process::fromShellCommandline() function. Critically, the interpolation occurs prior to the execution of the slugify() sanitizer function, which is designed to strip or neutralize potentially dangerous characters.\nBecause the raw filename is processed directly by the shell, an attacker can supply a specially crafted video filename laden with shell metacharacters such as backticks (`` ` ``), command substitution syntax ($()), and semicolons (;). When Cockpit CMS interacts with FFmpeg to process the uploaded video file, these injected metacharacters allow the attacker to break out of the intended FFmpeg command context and append arbitrary shell commands.\nThe attack flow proceeds as follows: First, an authenticated user with assets/upload permissions crafts a malicious payload encapsulated within a video file's filename using shell metacharacters. Second, the user uploads the file through the standard asset management interface of Cockpit CMS. Third, the application passes the unsanitized filename into the Process::fromShellCommandline() method for FFmpeg processing. Fourth, the underlying operating system shell interprets the embedded metacharacters, executing the attacker-supplied commands with the privileges of the web-server user.\nThe requirements for exploitation include authenticated access to the application and the possession of the specific assets/upload privilege. The vulnerable component is the asset processing pipeline interacting with FFmpeg. The post-exploitation impact includes arbitrary code execution, complete control over the application environment depending on web-server privileges, and potential internal network pivoting."
}