CVE-2010-2235
Cobbler is vulnerable to code injection
CVE-2010-2235 is a high vulnerability (CVSS 8.5) in Michael Dehaan Cobbler, published December 9, 2010. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.29%, the 88th percentile. Fixed in cobbler 2.0.7.
template_api.py in Cobbler before 2.0.7, as used in Red Hat Network Satellite Server and other products, does not disable the ability of the Cheetah template engine to execute Python statements contained in templates, which allows remote authenticated administrators to execute arbitrary code via a crafted kickstart template file, a different vulnerability than CVE-2008-6954.
Exploit likelihood
What each source reports
NVD Score used
template_api.py in Cobbler before 2.0.7, as used in Red Hat Network Satellite Server and other products, does not disable the ability of the Cheetah template engine to execute Python statements contained in templates, which allows remote authenticated administrators to execute arbitrary code via a crafted kickstart template file, a different vulnerability than CVE-2008-6954.
- Record
CVE-2010-2235- CVSS 2.0
- 8.5 High
AV:N/AC:M/Au:S/C:C/I:C/A:C - Weakness
- CWE-94
- Updated
- 2026-11-02
CVE List No score
template_api.py in Cobbler before 2.0.7, as used in Red Hat Network Satellite Server and other products, does not disable the ability of the Cheetah template engine to execute Python statements contained in templates, which allows remote authenticated administrators to execute arbitrary code via a crafted kickstart template file, a different vulnerability than CVE-2008-6954.
- Record
CVE-2010-2235- Updated
- 2026-11-02
EUVDEUVD-2022-4375 No score
template_api.py in Cobbler before 2.0.7, as used in Red Hat Network Satellite Server and other products, does not disable the ability of the Cheetah template engine to execute Python statements contained in templates, which allows remote authenticated administrators to execute arbitrary code via a crafted kickstart template file, a different vulnerability than CVE-2008-6954.
- Record
EUVD-2022-4375- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jhm7-38xj-pvm8 No score
Cobbler is vulnerable to code injection
template_api.py in Cobbler before 2.0.7, as used in Red Hat Network Satellite Server and other products, does not disable the ability of the Cheetah template engine to execute Python statements contained in templates, which allows remote authenticated administrators to execute arbitrary code via a crafted kickstart template file, a different vulnerability than CVE-2008-6954.
- Record
GHSA-jhm7-38xj-pvm8- Weakness
- CWE-94
- Updated
- 2026-11-02
OSVGHSA-jhm7-38xj-pvm8 No score
Cobbler is vulnerable to code injection
template_api.py in Cobbler before 2.0.7, as used in Red Hat Network Satellite Server and other products, does not disable the ability of the Cheetah template engine to execute Python statements contained in templates, which allows remote authenticated administrators to execute arbitrary code via a crafted kickstart template file, a different vulnerability than CVE-2008-6954.
- Record
GHSA-jhm7-38xj-pvm8- Weakness
- CWE-94
- Updated
- 2026-11-02
OSVPYSEC-2026-794 No score
Cobbler is vulnerable to code injection
template_api.py in Cobbler before 2.0.7, as used in Red Hat Network Satellite Server and other products, does not disable the ability of the Cheetah template engine to execute Python statements contained in templates, which allows remote authenticated administrators to execute arbitrary code via a crafted kickstart template file, a different vulnerability than CVE-2008-6954.
- Record
PYSEC-2026-794- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cobblerPyPI |
before 2.0.7 | 2.0.7 |
cobblerPyPI |
before 2.0.7, plus listed versions 0.6.3-2 |
2.0.7 |
cobblerRed Hat:network_satellite:5.3::el4 |
before 0:1.6.6-15.el4sat | 0:1.6.6-15.el4sat |
cobbler-debuginfoRed Hat:network_satellite:5.3::el4 |
before 0:1.6.6-15.el4sat | 0:1.6.6-15.el4sat |
cobblerRed Hat:network_satellite:5.3::el5 |
before 0:1.6.6-15.el5sat | 0:1.6.6-15.el5sat |
cobbler-debuginfoRed Hat:network_satellite:5.3::el5 |
before 0:1.6.6-15.el5sat | 0:1.6.6-15.el5sat |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |