---
id: CVE-2018-1000225
aliases:
  - GHSA-q9g5-98pm-w6q7
  - PYSEC-2026-796
title: Cobbler XSS Vulnerability
summary: Cobbler XSS Vulnerability
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
vendor: cobbler
product: cobbler
ecosystem: pip
affected:
  - cobbler <= 2.6.11
published: '2022-05-14'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-q9g5-98pm-w6q7'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2018-1000225'
  - url: 'https://github.com/cobbler/cobbler/issues/1917'
  - url: 'https://github.com/cobbler/cobbler'
  - url: 'https://github.com/cobbler/cobbler/blob/master/cobbler/remote.py#L2236'
  - url: >-
      https://movermeyer.com/2018-08-02-privilege-escalation-exploits-in-cobblers-api
tags:
  - osv
  - pip
epss: 0.01272
epssPercentile: 0.68586
ingestedAt: '2026-07-08T18:25:52.371Z'
---

## Overview

Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older versions may be vulnerable contains a Cross Site Scripting (XSS) vulnerability in cobbler-web that can result in Privilege escalation to admin.. This attack appear to be exploitable via "network connectivity". Sending unauthenticated JavaScript payload to the Cobbler XMLRPC API (/cobbler_api).

## Affected packages

- `cobbler <= 2.6.11`

## Remediation

Refer to the advisory for the patched release.