The vulnerability is an OS command injection flaw where the file name supplied during an upload is inserted into a shell command that calls FFmpeg without proper sanitization. A user who is authenticated and possesses only the assets/upload permission can craft a filename containing shell metacharacters such as backticks, $(), or semicolons that are executed by the web‑server process. The result is the arbitrary execution of system commands with the privileges of the web server, allowing attackers to read, modify, or delete data, and potentially pivot to other systems.

Cockpit CMS by Cockpit HQ, version 2.14.0 and all earlier releases. The flaw exists before the release that patched the command sanitization logic. The affected component is the FFmpeg integration used during video uploads.

The CVSS score of 8.7 indicates a high severity. Exploitation requires only that the user be authenticated with upload permission and that they upload a file with a malicious name, a scenario that can be achieved via web traffic. Because the command runs as the web‑server user, the impact can be system‑wide. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the high CVSS and the proven remote code execution capability make it a near‑term threat.