Sign in

6.5 Medium

CVE-2026-38993 Cockpit 2.13.5 and earlier is vulnerable to directory traversal via the Buckets component

Description

Cockpit 2.13.5 and earlier is vulnerable to directory traversal via the Buckets component. This vulnerability allows authenticated attackers to write files to arbitrary locations within the uploads directory or overwrite assets with malicious versions.

Affected products and versions

Product	Affected versions	Fixed in
n/a	Versions not published
Red Hat Enterprise Linux 10	Versions not published
Red Hat Enterprise Linux 7	Versions not published
Red Hat Enterprise Linux 8	Versions not published
Red Hat Enterprise Linux 9	Versions not published

The 144658 CVEs of n/a →

CVE-2026-106713 An issue in FreeReels for Android version 2.3.11 allows a remote attacker to obtain sensitive information via the… Not rated CVE-2026-106715 NewsBreak for Android version 26.21.0 treats data:text/html; URLs as trusted in its WebView JavaScript bridge origin… Not rated CVE-2026-106714 Chewy for Android version 26.23.0 does not adequately validate the host of a product-details deep link before loading it… Not rated CVE-2026-106716 ReelShort for Android version 3.8.55 loads an attacker-controlled activityUrl supplied through its cmsvictor://open deep… Not rated

Do you use n/a?

Track this CVE Watch n/a Check my SBOMs

www.cveye.io/en/cve/CVE-2026-38993

Timeline

Published April 29, 2026
Last modified July 15, 2026

References

github.com github.com
felsec.com felsec.com

Track this CVE