Description
A flaw was found in cobbler software component version 2.6.11-1. It suffers from an invalid parameter validation vulnerability, leading the arbitrary file reading. The flaw is triggered by navigating to a vulnerable URL via cobbler-web on a default installation.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| The cobbler Project | cobbler | 2.6.11-1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Manager Server 3.0 | cobbler | 2.6.6-48.1 | SUSE-SU-2017:1699-1 |
| SUSE Manager Client Tools 12 | cobbler | 2.6.6-48.1 | SUSE-SU-2017:1699-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | cobbler | 3.2.1.336+git.5639a3af-1.1 | openSUSE-SU-2024:10690-1 |
| openSUSE Tumbleweed | koan | 3.0.1-1.2 | openSUSE-SU-2024:10897-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | cobbler | <= 2.6.11-1 | — | GHSA-4vc9-4xpq-77vm |
Advisories 3
- openSUSE-SU-2024:10897-1 koan-3.0.1-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2017:1699-1 Security update for cobbler SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10690-1 cobbler-3.2.1.336+git.5639a3af-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026