NIXPKGS-2025-0011
published on 25 Sep 2025
by @Erethon Activity log
- Created automatic suggestion
- @Erethon dismissed
- @Erethon accepted
- @Erethon published on GitHub
Cockpit: command injection when deleting a sosreport with a crafted name
A flaw was found in Cockpit. Deleting a sosreport with a crafted name via the Cockpit web interface can lead to a command injection vulnerability, resulting in privilege escalation. This issue affects Cockpit versions 270 and newer.
Affected products
cockpit
- ==314
- *
- *
Matching in nixpkgs
pkgs.emacsPackages.test-cockpit
None
-
nixos-unstable 20240604.1943
- nixpkgs-unstable 20240604.1943