PYSEC-2026-795
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/cobbler/PYSEC-2026-795.yaml
- JSON Data
- https://api.osv.dev/v1/vulns/PYSEC-2026-795
- Aliases
-
- CVE-2008-6954
- GHSA-p8w2-f44p-fmcj
- Published
- 2026-07-06T08:03:24.945214Z
- Modified
- 2026-07-07T11:45:44.522058876Z
- Summary
- Cobbler Web Interface Kickstart Template Remote Privilege Escalation Vulnerability
- Details
-
The web interface (CobblerWeb) in Cobbler before 1.2.9 allows remote authenticated users to execute arbitrary Python code with the root privileges in cobblerd by editing a Cheetah kickstart template to import arbitrary Python modules.
- References
-
- https://nvd.nist.gov/vuln/detail/CVE-2008-6954
- https://exchange.xforce.ibmcloud.com/vulnerabilities/46625
- https://github.com/cobbler/cobbler
- https://web.archive.org/web/20111227125913/http://secunia.com/advisories/32804
- https://web.archive.org/web/20111227151912/http://secunia.com/advisories/32737
- https://web.archive.org/web/20200228143518/http://www.securityfocus.com/bid/32317
- https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00462.html
- https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00485.html
- http://freshmeat.net/projects/cobbler/releases/288374
- https://pypi.org/project/cobbler
- https://github.com/advisories/GHSA-p8w2-f44p-fmcj
Affected packages
PyPI / cobbler
Package
- Name
- cobbler
- View open source insights on deps.dev
- Purl
- pkg:pypi/cobbler