Cockpit CMS exposes an authenticated remote code execution vulnerability at the /cockpit/collections/save_collection endpoint. Authenticated attackers with collection management privileges can inject arbitrary PHP code via rule parameters; the code is written directly to server‑side PHP files and executed through PHP's include() mechanism. This flaw, identified as CWE‑94, allows an attacker to run arbitrary commands on the underlying server, compromising confidentiality, integrity and availability of the entire application and its host.

The affected product is Cockpit CMS. The specific affected versions are not listed in the CNA data, so any installed instance that has the /cockpit/collections/save_collection endpoint and collection rule functionality may be vulnerable until a patch is applied.

The CVSS score of 8.7 indicates a high severity vulnerability. The EPSS score is not available, and the flaw is not yet listed in the CISA KEV catalog. An attacker must be authenticated and possess collection‑management privileges, a set of rights that can be granted to a user after login. Once those prerequisites are met, the attacker can supply malicious parameters to the collection rule endpoint, causing the server to execute arbitrary PHP code.