{"id":"GHSA-96hw-v598-jvgh","aliases":["CVE-2017-1000469","PYSEC-2026-314"],"title":"Cobbler vulnerable to arbitrary code execution","description":"Cobbler version up to 2.8.2 is vulnerable to a command injection vulnerability in the \"add repo\" component resulting in arbitrary code execution as root user.","severity":"critical","score":9.8,"published":"2022-05-14T03:49:57.000Z","modified":"2026-10-27T16:30:06.485Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"PyPI","name":"cobbler","ranges":[{"events":[{"introduced":"0"},{"fixed":"3.0.0"}],"type":"ECOSYSTEM"}],"versions":["0.6.3-2"],"fixed":["3.0.0"]}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2017-1000469","https://github.com/cobbler/cobbler/issues/1845","https://github.com/cobbler/cobbler/commit/4b20397425a5d42a2d8927233654f4d7435bd4c2","https://github.com/cobbler/cobbler","https://github.com/pypa/advisory-database/tree/main/vulns/cobbler/PYSEC-2026-314.yaml","https://pypi.org/project/cobbler"],"sources":[{"name":"OSV","id":"GHSA-96hw-v598-jvgh","modified":"2026-10-27T16:30:06.485593449Z","url":"https://osv.dev/vulnerability/GHSA-96hw-v598-jvgh"}],"assessments":[{"source":"OSV","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8}]}