CVE-2008-6954: Michael Dehaan Cobbler

High severity, CVSS 9.0. EPSS: 2.2% chance of exploitation in the next 30 days.

The web interface (CobblerWeb) in Cobbler before 1.2.9 allows remote authenticated users to execute arbitrary Python code in cobblerd by editing a Cheetah kickstart template to import arbitrary Python modules.

Affected products

• Michael Dehaan Cobbler: up to and including 1.2.8; version 0.1.1.7 only; version 0.2.1 only; version 0.2.2 only; version 0.2.3 only; version 0.2.5 only; …

Published 2009-08-12. Last modified 2026-06-16.