Vulnerability · Published Aug 14, 2026 · Assigned by VulnCheck

CVE-2026-73680Cockpit CMS 2.14.0 Authenticated Command Injection via FFmpeg Filename

High 8.8

In plain English

A high-severity OS command injection in Cockpit CMS from Cockpit HQ. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.8% (higher than 87% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)2.8%top 13.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Cockpit CMS 2.14.0 and prior contains a command injection vulnerability in the FFmpeg integration that allows authenticated users with only the assets/upload permission to execute arbitrary commands by uploading a video file with a shell metacharacter-laden filename. The unsanitized filename is interpolated into a shell command executed via Process::fromShellCommandline() before the slugify() sanitizer runs, enabling injected shell metacharacters such as backticks, $(), and semicolons to escape the FFmpeg command context and execute as the web-server user.

Affected products (as reported)

Vendor	Product	Versions
Cockpit HQ	Cockpit CMS	0 – through 2.14.0

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Product Repository product
Public Reference technical-description
Patch Commit patch
https://www.vulncheck.com/advisories/cockpit-cms-authenticated-command-injection-via-ffmpeg-filename third-party-advisory