{"action":"Upgrade cockpit-hq/cockpit to 2.7.0 or later.","affected":[{"fixed":"2.7.0","introduced":"0"}],"component":"cockpit-hq/cockpit","cve_ids":["CVE-2024-4825"],"ecosystem":"Packagist","epss":0.00719,"exploited":false,"fixed_versions":["2.7.0"],"ghsa_id":"GHSA-vpj8-xfqc-jcv9","id":"tcs_01M5KF9A55Y8NB3QWK24DJWDTS","modified_at":"2024-05-19T02:24:47.887663Z","published_at":"2024-05-14T18:30:57Z","references":["https://osv.dev/vulnerability/GHSA-vpj8-xfqc-jcv9","https://nvd.nist.gov/vuln/detail/CVE-2024-4825","https://github.com/Cockpit-HQ/Cockpit","https://www.incibe.es/en/incibe-cert/notices/aviso/unrestricted-upload-file-dangerous-type-vulnerability-cockpit-cms"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-vpj8-xfqc-jcv9","url":"https://osv.dev/vulnerability/GHSA-vpj8-xfqc-jcv9"}],"summary":"Cockpit CMS contains an arbitrary file upload vulenrability"}