A flaw in Cockpit CMS versions before 2.14.0 permits an attacker to inject code through the filter parameter of several endpoints. The injected value is evaluated by the MongoLite database using the $func operator, which can invoke arbitrary system commands. This vulnerability leads directly to uncontrolled code execution on the underlying host, exposing the full confidentiality, integrity, and availability of the server. The weakness aligns with command and code injection issues such as CWE‑78 and CWE‑94.

The security issue affects Cockpit CMS releases 2.13.5 and earlier. Any installation running those versions exposes the vulnerable endpoints. The official advisory lists the affected release as 2.13.5 and the new release 2.14.0 that includes the fix.

With no CVSS score publicly available and EPSS marked as not available, the exact severity rating cannot be determined from the data shown. However, because the vulnerability allows arbitrary command execution and is exposed over network endpoints, it is likely exploitable remotely and would be considered high risk by most organizations. The lack of KEV listing does not reduce the urgency, as the flaw is clearly exploitable regardless of current exploit availability.