CVE-2017-1000469: Cobbler vulnerable to arbitrary code execution

May 14, 2022 (updated October 27, 2026)

Cobbler version up to 2.8.2 is vulnerable to a command injection vulnerability in the “add repo” component resulting in arbitrary code execution as root user.

References

github.com/advisories/GHSA-96hw-v598-jvgh
github.com/cobbler/cobbler/commit/4b20397425a5d42a2d8927233654f4d7435bd4c2
github.com/cobbler/cobbler/issues/1845
github.com/pypa/advisory-database/tree/main/vulns/cobbler/PYSEC-2026-314.yaml
nvd.nist.gov/vuln/detail/CVE-2017-1000469
pypi.org/project/cobbler

Code Behaviors & Features

Detect and mitigate CVE-2017-1000469 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →