Cockpit CMS exposes an SQL Injection flaw in its MongoLite Aggregation Optimizer. Unsanitized field names in aggregation queries allow attackers to inject arbitrary SQL via the toJsonExtractRaw() method. This injection can breach the published-content filter, letting even a read‑only API key read unpublished or restricted content from the underlying SQLite database. The result is unauthorized data exposure, potentially giving attackers sensitive information without requiring administrative privileges.

This vulnerability affects the Cockpit content management system by Cockpit-HQ. Any deployment running version 2.13.4 or older, with API access enabled and the /api/content/aggregate/{model} endpoint reachable by untrusted users, is susceptible. Core products using the affected stack include Cockpit 2.13.4 and earlier. No other vendors or products are listed.

The CVSS vector scores 7.7 for high severity, while the EPSS is below 1%, indicating a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires network access to the API endpoint and a valid read‑only API key but no admin rights. Attackers could send crafted aggregation payloads to trigger the SQL injection, read data from the SQLite store, and bypass content restrictions. A patch addressing the sanitization of toJsonExtractRaw() is available in version 2.13.5.