Read the docs
TI-2026-41659 Aliases CVE-2026-57855GHSA-fjpv-pfvg-c462

Cockpit CMS Missing Authorization in Bucket File Storage API

Priority HIGH 73CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-284.

Summary

Cockpit CMS contains a missing authorization vulnerability in the Bucket file storage API (/system/buckets/api). The api() method in modules/System/Controller/Buckets.php executes bucket commands (ls, upload, removefiles, rename, createfolder) without performing any ACL or role check. Any authenticated user, regardless of role, can perform all bucket operations on any named bucket, including buckets intended for admin use only.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00523 44th percentileScored 2026-11-07
Fix Fixed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

No affected products listed by the sources yet.

Remediation

No fixed version listed by the sources yet.

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Cockpit CMS 2.14.0

    2 records Highest priority Priority HIGH 2 HIGH

    Other records, highest priority first

    • TI-2026-41660 Cockpit CMS Path Traversal via Bucket Name in Bucket File Storage APIPriority HIGH 73
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-57855
  2. 2026-10-03 Alias added: GHSA-fjpv-pfvg-c462

References

Patch 1

Other 2

  • TI-2020-18291 Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php resetpassword function. CVSS 3.1CRITICAL 9.8
  • TI-2020-18290 Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php check function. CVSS 3.1CRITICAL 9.8
  • TI-2022-02511 Insufficient Session Expiration in cockpit-hq/cockpit CVSS 3.1CRITICAL 9.8
  • TI-2020-18292 Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php newpassword function. CVSS 3.1CRITICAL 9.8
  • TI-2026-42071 Cockpit CMS 2.14.0 - Path Traversal Local File Inclusion via index.php CVSS 4.0HIGH 8.2
  • TI-2026-41660 Cockpit CMS Path Traversal via Bucket Name in Bucket File Storage API CVSS 4.0HIGH 8.7
See all 40 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences