---
id: CVE-2026-73680
title: Cockpit CMS 2.14.0 Authenticated Command Injection via FFmpeg Filename
summary: >-
  Cockpit CMS 2.14.0 and prior contains a command injection vulnerability in the
  FFmpeg integration that allows authenticated users with only the assets/upload
  permission to execute arbitrary commands by uploading a video file with a
  shell…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-78
vendor: Cockpit HQ
product: Cockpit CMS
affected:
  - cockpit_cms <= 2.14.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-08-17T15:52:46.076549Z'
published: '2026-08-14'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T14:19:11.604Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-73680'
references:
  - url: 'https://github.com/Cockpit-HQ/Cockpit'
    label: Product Repository
  - url: 'https://link.mateocallec.com/MFC-2026-002'
    label: Public Reference
  - url: >-
      https://github.com/Cockpit-HQ/Cockpit/commit/28813596f57685f63d3a48f655e8e9bd2b535cab
    label: Patch Commit
  - url: >-
      https://www.vulncheck.com/advisories/cockpit-cms-authenticated-command-injection-via-ffmpeg-filename
tags:
  - cve.org
epss: 0.01476
epssPercentile: 0.72744
ingestedAt: '2026-09-24T15:45:56.705Z'
---

## Overview

Cockpit CMS 2.14.0 and prior contains a command injection vulnerability in the FFmpeg integration that allows authenticated users with only the assets/upload permission to execute arbitrary commands by uploading a video file with a shell metacharacter-laden filename. The unsanitized filename is interpolated into a shell command executed via Process::fromShellCommandline() before the slugify() sanitizer runs, enabling injected shell metacharacters such as backticks, $(), and semicolons to escape the FFmpeg command context and execute as the web-server user.

## Affected

- `cockpit_cms <= 2.14.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.