Read the docs
TI-2026-41660 Aliases CVE-2026-57856GHSA-cfx5-q5qm-x936

Cockpit CMS Path Traversal via Bucket Name in Bucket File Storage API

Priority HIGH 73CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Cockpit CMS contains a path traversal vulnerability in the Bucket file storage API (/system/buckets/api). The api() method in modules/System/Controller/Buckets.php sanitizes the bucket name with preg_replace('/[^a-zA-Z0-9-_\\.]/','', $bucket), which permits '..' and '../' sequences. The sanitized value is interpolated into a Flysystem path as uploads://buckets/{bucket}. Flysystem's WhitespacePathNormalizer resolves 'buckets/..' to the empty string (the uploads storage root) without raising PathTraversalDetected because the '..' has a preceding component to consume. An authenticated low-privileged user can send a crafted request with a '../' bucket name to list, upload, and delete files across all buckets, including those belonging to other users or roles

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00479 41st percentileScored 2026-11-07
Fix Fixed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

No affected products listed by the sources yet.

Remediation

No fixed version listed by the sources yet.

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Cockpit CMS 2.14.0

    2 records Highest priority Priority HIGH 2 HIGH

    Other records, highest priority first

    • TI-2026-41659 Cockpit CMS Missing Authorization in Bucket File Storage APIPriority HIGH 73
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-57856
  2. 2026-10-03 Alias added: GHSA-cfx5-q5qm-x936

References

Patch 1

Other 2

  • TI-2020-18291 Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php resetpassword function. CVSS 3.1CRITICAL 9.8
  • TI-2020-18290 Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php check function. CVSS 3.1CRITICAL 9.8
  • TI-2022-02511 Insufficient Session Expiration in cockpit-hq/cockpit CVSS 3.1CRITICAL 9.8
  • TI-2020-18292 Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php newpassword function. CVSS 3.1CRITICAL 9.8
  • TI-2026-42071 Cockpit CMS 2.14.0 - Path Traversal Local File Inclusion via index.php CVSS 4.0HIGH 8.2
  • TI-2026-41659 Cockpit CMS Missing Authorization in Bucket File Storage API CVSS 4.0HIGH 8.7
See all 40 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences