CVE-2008-6954
Cobbler Web Interface Kickstart Template Remote Privilege Escalation Vulnerability
CVE-2008-6954 is a high vulnerability (CVSS 9.0) in Michael Dehaan Cobbler, published August 12, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.16%, the 82nd percentile. Fixed in cobbler 1.2.9.
The web interface (CobblerWeb) in Cobbler before 1.2.9 allows remote authenticated users to execute arbitrary Python code in cobblerd by editing a Cheetah kickstart template to import arbitrary Python modules.
Exploit likelihood
What each source reports
NVD Score used
The web interface (CobblerWeb) in Cobbler before 1.2.9 allows remote authenticated users to execute arbitrary Python code in cobblerd by editing a Cheetah kickstart template to import arbitrary Python modules.
- Record
CVE-2008-6954- CVSS 2.0
- 9.0 High
AV:N/AC:L/Au:S/C:C/I:C/A:C - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
The web interface (CobblerWeb) in Cobbler before 1.2.9 allows remote authenticated users to execute arbitrary Python code in cobblerd by editing a Cheetah kickstart template to import arbitrary Python modules.
- Record
CVE-2008-6954- Updated
- 2026-11-02
EUVDEUVD-2022-4717 No score
The web interface (CobblerWeb) in Cobbler before 1.2.9 allows remote authenticated users to execute arbitrary Python code in cobblerd by editing a Cheetah kickstart template to import arbitrary Python modules.
- Record
EUVD-2022-4717- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-p8w2-f44p-fmcj No score
Cobbler Web Interface Kickstart Template Remote Privilege Escalation Vulnerability
The web interface (CobblerWeb) in Cobbler before 1.2.9 allows remote authenticated users to execute arbitrary Python code with the root privileges in cobblerd by editing a Cheetah kickstart template to import arbitrary Python modules.
- Record
GHSA-p8w2-f44p-fmcj- Weakness
- CWE-94
- Updated
- 2026-11-02
OSVGHSA-p8w2-f44p-fmcj No score
Cobbler Web Interface Kickstart Template Remote Privilege Escalation Vulnerability
The web interface (CobblerWeb) in Cobbler before 1.2.9 allows remote authenticated users to execute arbitrary Python code with the root privileges in cobblerd by editing a Cheetah kickstart template to import arbitrary Python modules.
- Record
GHSA-p8w2-f44p-fmcj- Weakness
- CWE-94
- Updated
- 2026-11-02
OSVPYSEC-2026-795 No score
Cobbler Web Interface Kickstart Template Remote Privilege Escalation Vulnerability
The web interface (CobblerWeb) in Cobbler before 1.2.9 allows remote authenticated users to execute arbitrary Python code with the root privileges in cobblerd by editing a Cheetah kickstart template to import arbitrary Python modules.
- Record
PYSEC-2026-795- Updated
- 2026-11-02
Affected products
Affected packages
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
redhat.com/archives/fedora-package-announce/2008-November/msg00462.html
osvdb.org/50291
secunia.com/advisories/32804
exchange.xforce.ibmcloud.com/vulnerabilities/46625
Show 9 moreShow less
securityfocus.com/bid/32317
freshmeat.net/projects/cobbler/releases/288374
nvd.nist.gov/vuln/detail/CVE-2008-6954
web.archive.org/web/20111227125913/http://secunia.com/advisories/32804
github.com/advisories/GHSA-p8w2-f44p-fmcj
pypi.org/project/cobbler