CVE-2026-38993: Red Hat Enterprise Linux 10

Medium severity, CVSS 6.5. EPSS: 1% chance of exploitation in the next 30 days.

Cockpit 2.13.5 and earlier is vulnerable to directory traversal via the Buckets component. This vulnerability allows authenticated attackers to write files to arbitrary locations within the uploads directory or overwrite assets with malicious versions.

Affected products

• Red Hat Red Hat Enterprise Linux 10
• Red Hat Red Hat Enterprise Linux 7
• Red Hat Red Hat Enterprise Linux 8
• Red Hat Red Hat Enterprise Linux 9

Published 2026-04-29. Last modified 2026-07-15.