Cobbler before 3.3.0 allows log poisoning

CRITICAL 9.8CVE-2021-40323 · GHSA-cpqf-3c3r-c9g2 · PYSEC-2021-373 · Published 04/10/2021 · updated 17/06/2026

Package	Affected versions	Patched versions
cobbler PyPI	`< 3.3.0`	`3.3.0`
cobbler cobbler_project	`≤ 3.3.0`	No fix yet

Description

Cobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template injection.

NVD description

Cobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template injection.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.