CVE-2020-35131: Cockpit PHP code injection in MongoLite Database leads to RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable PHP code injection with a public exploit and very high EPSS score warrants immediate patching.

What it is

Cockpit before 0.6.1 passes attacker-controlled JSON values into registerCriteriaFunction in lib/MongoLite/Database.php, allowing injection of custom PHP code. Because the injected code executes on the server, this is a full remote command execution flaw in an unauthenticated web-reachable component.

Impact

An attacker can execute arbitrary PHP and operating system commands on the Cockpit host, leading to full server compromise and access to data and credentials handled by the application.

Attack surface

Reachable over the network through the /auth/check or /auth/requestreset URIs by supplying crafted JSON data; the CVSS vector indicates no privileges or user interaction are required.

Exploitation

A public Exploit-DB entry (49390) exists, and EPSS is 0.51299 (98.9th percentile), indicating high likelihood of exploitation; it is not listed in CISA KEV.

What to do

• Upgrade Cockpit to 0.6.1 or later, which contains the fix in lib/MongoLite/Database.php.
• If immediate upgrade is not possible, restrict network access to /auth/check and /auth/requestreset and to the Cockpit instance generally.
• Review and harden any custom code paths that pass user-supplied JSON into MongoLite query criteria functions.
• Run the Cockpit service with least privilege and in a segregated environment to limit post-exploitation reach.

Detection

• Inspect web logs for POST requests to /auth/check or /auth/requestreset containing PHP code or unusual JSON structures.
• Monitor for unexpected PHP process execution or child processes spawned by the web server.
• Look for newly written or modified PHP files under the Cockpit webroot that were not part of a deployment.
• Alert on outbound network connections from the Cockpit host that are inconsistent with normal application behavior.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.