{"id":"CVE-2017-1000469","kind":"vulnerability","aliases":["CVE-2017-1000469","GHSA-96hw-v598-jvgh"],"related":[],"title":"Cobbler vulnerable to arbitrary code execution","description":"Cobbler version up to 2.8.2 is vulnerable to a command injection vulnerability in the \"add repo\" component resulting in arbitrary code execution as root user.","summary":"Cobbler up to 2.8.2 passes input from its \"add repo\" component into a shell command without sanitizing it. An attacker who can reach that function can run arbitrary commands as root on the Cobbler server.","severity":"critical","cvss":10.0,"epss":0.05556,"exploited":false,"exploited_at":null,"products":[{"name":"cobbler","fixed":["3.0.0"],"affected":"<= 2.8.2","ecosystem":"pypi"},{"name":"cobbler project cobbler","fixed":[],"affected":"<= 2.8.2","ecosystem":"vendor"}],"ecosystems":["pypi","vendor"],"tags":["cobbler","cwe-20","linux-provisioning","package","python","self-hosted"],"not_affected_if":["version-3.0.0-or-later"],"how_to_check":"- `pip show cobbler` or `cobbler version` to read the installed version\n- Check whether the installed version is at or below `2.8.2`","fix":"- Upgrade the Cobbler package to `3.0.0` or later\n- unknown for interim mitigations if an upgrade is not possible","status":"open","published_at":"2018-01-03T20:29:00+00:00","first_seen_at":"2026-10-27T16:20:27+00:00","triaged_at":"2026-10-27T16:21:24+00:00","updated_at":"2026-10-27T16:33:08+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-27T16:21:24Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the Cobbler package to `3.0.0` or later\n- unknown for interim mitigations if an upgrade is not possible","reach":"unknown","title":"Cobbler: command injection in add-repo lets attackers run code as root","impact":"high","summary":"Cobbler up to 2.8.2 passes input from its \"add repo\" component into a shell command without sanitizing it. An attacker who can reach that function can run arbitrary commands as root on the Cobbler server.","category":"package","nicknames":[],"who_cares":["cobbler","python","self-hosted","linux-provisioning"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Code runs as root on the Cobbler server","analyst_note":"","how_to_check":"- `pip show cobbler` or `cobbler version` to read the installed version\n- Check whether the installed version is at or below `2.8.2`","needs_analyst":false,"not_affected_if":["version-3.0.0-or-later"],"who_is_affected":"Teams running Cobbler 2.8.2 or earlier as a provisioning server, where the add-repo function is reachable by a user who can send it input. Whether a remote attacker can reach it depends on how the web and XML-RPC interfaces are exposed, which the sources do not say. Installations already on 3.0.0 or later are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000582,"input_tokens":3311,"output_tokens":502,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-1000469':9A,17A '-20':24B '-2017':8A,16A '2.8.2':36B,72C '96hw':12A 'add':41B,82C 'arbitrari':4A,60B,87C 'attack':52B 'cobbler':1A,18A,19A,21A,22B,33B,66B,68C 'code':5A,88C 'command':47B,61B,77C 'compon':43B,84C 'cve':7A,15A 'cwe':23B 'execut':6A,89C 'function':57B 'ghsa':11A 'ghsa-96hw-v598-jvgh':10A 'host':32B 'inject':78C 'input':38B 'jvgh':14A 'linux':26B 'linux-provis':25B 'packag':28B 'pass':37B 'project':20A 'provis':27B 'python':29B 'reach':55B 'repo':42B,83C 'result':85C 'root':63B,91C 'run':59B 'sanit':49B 'self':31B 'self-host':30B 'server':67B 'shell':46B 'user':92C 'v598':13A 'version':69C 'vulner':2A,74C,79C 'without':48B","nicknames":[],"mitigations":[],"who_affected":"Teams running Cobbler 2.8.2 or earlier as a provisioning server, where the add-repo function is reachable by a user who can send it input. Whether a remote attacker can reach it depends on how the web and XML-RPC interfaces are exposed, which the sources do not say. Installations already on 3.0.0 or later are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2018-01-03T20:29:00+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-96hw-v598-jvgh","url":"https://github.com/advisories/GHSA-96hw-v598-jvgh","severity":"critical","published_at":"2022-05-14T03:49:57+00:00","modified_at":"2026-10-27T16:18:29+00:00","first_seen_at":"2026-10-27T16:20:27+00:00","fetched_at":"2026-10-27T16:20:27+00:00","note":null},{"source":"nvd","external_id":"CVE-2017-1000469","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000469","severity":null,"published_at":"2018-01-03T20:29:00+00:00","modified_at":"2026-06-17T00:59:13+00:00","first_seen_at":"2026-10-27T16:33:08+00:00","fetched_at":"2026-10-27T16:33:08+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}