CVE-2025-1025

Versions of the package cockpit-hq/cockpit before 2.4.1 are vulnerable to Arbitrary File Upload where an attacker can use different extension to bypass the upload filter.

Published: Feb 5, 2025
Updated: Jun 30, 2025
CVE: CVE-2025-1025
GHSA: GHSA-wp68-xrfg-xvq4
Severity: High
Exploit:

CVSS v3:

Severity: Unknown
Score:
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CWEs:

CWE-434

Affected Software
References

Software	From	Fixed in
cockpit-hq / cockpit	-	2.4.1

https://gist.github.com/CHOOCS/fe1227443544d5d74c33982814f290af
https://github.com/Cockpit-HQ/Cockpit/commit/984ef9ad270357b843af63c81db95178eae42cae
https://github.com/Cockpit-HQ/Cockpit/commit/becca806c7071ecc732521bb5ad0bb9c64299592
https://security.snyk.io/vuln/SNYK-PHP-COCKPITHQCOCKPIT-8516320

Vulnerability Database

289,599

CVE-2025-1025