CVE-2026-57856 Details
Description
Cockpit CMS contains a path traversal vulnerability in the Bucket file storage API (/system/buckets/api). The api() method in modules/System/Controller/Buckets.php sanitizes the bucket name with preg_replace('/[^a-zA-Z0-9-_\\.]/','', $bucket), which permits '..' and '../' sequences. The sanitized value is interpolated into a Flysystem path as uploads://buckets/{bucket}. Flysystem's WhitespacePathNormalizer resolves 'buckets/..' to the empty string (the uploads storage root) without raising PathTraversalDetected because the '..' has a preceding component to consume. An authenticated low-privileged user can send a crafted request with a '../' bucket name to list, upload, and delete files across all buckets, including those belonging to other users or roles
A path traversal vulnerability has been identified in Cockpit CMS versions prior to 2.14.0, within the Bucket file storage API. The vulnerability arises because the 'api()' method in 'modules/System/Controller/Buckets.php' improperly sanitizes bucket names, allowing the inclusion of '..' and '../' sequences. This sanitized value is then used in a Flysystem path, where Flysystem's WhitespacePathNormalizer resolves 'buckets/..' to the uploads storage root without triggering a path traversal detection. As a result, an authenticated low-privileged user can exploit this vulnerability to list, upload, and delete files across all buckets, including those belonging to other users or roles.
Users can update to Cockpit CMS version 2.14.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 13, 2026CISA-ADP
Assessed Jul 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gist.github.com/sermikr0/821c4edd3c34e98a62a50b07707785bd | CISA-ADP | BundleExploitTechnical Analysis |
| https://gist.github.com/sermikr0/821c4edd3c34e98a62a50b07707785bd | [email protected] | BundleExploitTechnical Analysis |
| https://github.com/cockpit-hq/cockpit | [email protected] | Vendor |
| https://github.com/Cockpit-HQ/Cockpit/commit/dde2d1d74f5f4e11de42a298918ea8c9684f932c | [email protected] | Source CodeVendor |
| https://www.vulncheck.com/advisories/cockpit-cms-missing-authorization-in-bucket-file-storage-api | [email protected] | AdvisoryNot Applicable |
| https://www.vulncheck.com/advisories/cockpit-cms-path-traversal-via-bucket-name-in-bucket-file-storage-api | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Cockpit CMS | < 2.14.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 14, 2026 | CVE Modified | CISA-ADP |
| Jul 13, 2026 | New CVE Received | [email protected] |