{"id":"CVE-2026-73680","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-73680","summary":"Cockpit CMS 2.14.0 and prior contains a command injection vulnerability in the FFmpeg integration that allows authenticated users with only the assets/upload permission to execute arbitrary…","details":"Cockpit CMS 2.14.0 and prior contains a command injection vulnerability in the FFmpeg integration that allows authenticated users with only the assets/upload permission to execute arbitrary commands by uploading a video file with a shell metacharacter-laden filename. The unsanitized filename is interpolated into a shell command executed via Process::fromShellCommandline() before the slugify() sanitizer runs, enabling injected shell metacharacters such as backticks, $(), and semicolons to escape the FFmpeg command context and execute as the web-server user.","published":"2026-08-14T20:16:58.080","modified":"2026-08-14T20:16:58.080","cvss":{"score":8.8,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":{"url":"https://github.com/Cockpit-HQ/Cockpit/commit/28813596f57685f63d3a48f655e8e9bd2b535cab","label":"Cockpit-HQ/Cockpit@2881359"},"references":[{"type":"WEB","url":"https://github.com/Cockpit-HQ/Cockpit"},{"type":"WEB","url":"https://github.com/Cockpit-HQ/Cockpit/commit/28813596f57685f63d3a48f655e8e9bd2b535cab"},{"type":"WEB","url":"https://link.mateocallec.com/MFC-2026-002"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/cockpit-cms-authenticated-command-injection-via-ffmpeg-filename"}],"provenance":{"sources":["OSV.dev","NVD","FIRST.org (EPSS)"],"lastVerified":"2026-08-14T20:16:58.080"}}