Cockpit CMS 2.13.5 and earlier contain a directory traversal flaw in the Buckets component that lets an authenticated user supply a path that resolves outside the intended uploads directory. This permits the creation or overwrite of arbitrary files within the application’s upload area, enabling malicious asset injection or replacement of legitimate files.

The vulnerability affects Cockpit CMS version 2.13.5 and all earlier releases. Only users who can authenticate to the CMS can exploit the flaw.

The flaw requires authenticated access, so its exploitation requires that attackers obtain (or already possess) legitimate credentials. While no public EPSS score is available, the lack of a CISA KEV listing suggests no widespread exploitation has been documented. The potential impact includes site compromise through malicious asset injection, and remediation is available in release 2.14.0. The attack vector is most likely local path manipulation within the Buckets upload handling code.