Read the docs
TI-2026-42071 Aliases CVE-2026-58467GHSA-f6g9-3r3j-32rg

Cockpit CMS 2.14.0 - Path Traversal Local File Inclusion via index.php

Priority HIGH 75CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-22 and the CVSS impact.

Summary

Cockpit CMS through 2.14.0 contains a path traversal and local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files or execute PHP files by including unvalidated PATH_INFO derived from REQUEST_URI in filesystem path construction without containment checks. Attackers can inject dot-dot sequences into the URL to traverse outside the designated spaces directory, and when the resolved path ends with a .php extension, the application passes it to include(), enabling local file inclusion on deployments using the PHP built-in server or certain non-default Nginx configurations.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0173 77th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
cockpit-hqcockpitup to 2.14.0—No fix listedCNA
  • cockpit Vendorcockpit-hq Affected up to 2.14.0 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 10AffectedNo fix yet
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 8AffectedNo fix yet
Red Hat Enterprise Linux 9AffectedNo fix yet

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-58467
  2. 2026-10-03 Alias added: GHSA-f6g9-3r3j-32rg

References

Exploit 1

  • TI-2020-18291 Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php resetpassword function. CVSS 3.1CRITICAL 9.8
  • TI-2020-18290 Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php check function. CVSS 3.1CRITICAL 9.8
  • TI-2022-02511 Insufficient Session Expiration in cockpit-hq/cockpit CVSS 3.1CRITICAL 9.8
  • TI-2020-18292 Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php newpassword function. CVSS 3.1CRITICAL 9.8
  • TI-2026-41660 Cockpit CMS Path Traversal via Bucket Name in Bucket File Storage API CVSS 4.0HIGH 8.7
  • TI-2026-41659 Cockpit CMS Missing Authorization in Bucket File Storage API CVSS 4.0HIGH 8.7
See all 40 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences