Which versions of Cockpit CMS are affected by CVE-2026-57856?

Cockpit CMS versions before 2.14.0 contain a privilege escalation vulnerability that allows authenticated users to access and modify files across all storage buckets regardless of their assigned…. A patch is available.

How to fix or mitigate CVE-2026-57856?

Within 24 hours, identify and document all Cockpit CMS deployments and their current versions. Within 7 days, test Cockpit CMS 2.14.0 or later in a staging environment and deploy the patch to all production instances. Within 30 days, review file access and modification logs from the period between vulnerability disclosure and patch deployment to identify any unauthorized activity.

Cockpit CMS CVE-2026-57856

Q: What is the CVSS score of CVE-2026-57856?

CVE-2026-57856 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

HIGH

Path Traversal (CWE-22)

2026-07-13 VulnCheck

PHP Path Traversal Cockpit Cms Cockpit Hq

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network API reachable with low-complexity '../' payload; requires an authenticated low-privileged account (PR:L); traversal enables cross-bucket read, write, and delete so C/I/A all High; scope unchanged within the app's own storage.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 13, 2026 - 23:15 vuln.today

Analysis Generated

Jul 13, 2026 - 23:15 vuln.today

CVE Published

Jul 13, 2026 - 22:41 cve.org

HIGH 8.7

DescriptionCVE.org

Cockpit CMS contains a path traversal vulnerability in the Bucket file storage API (/system/buckets/api). The api() method in modules/System/Controller/Buckets.php sanitizes the bucket name with preg_replace('/[^a-zA-Z0-9-_\\.]/','', $bucket), which permits '..' and '../' sequences. The sanitized value is interpolated into a Flysystem path as uploads://buckets/{bucket}. Flysystem's WhitespacePathNormalizer resolves 'buckets/..' to the empty string (the uploads storage root) without raising PathTraversalDetected because the '..' has a preceding component to consume. An authenticated low-privileged user can send a crafted request with a '../' bucket name to list, upload, and delete files across all buckets, including those belonging to other users or roles

AnalysisAI

Path-traversal privilege escalation in Cockpit CMS Bucket file storage API (before 2.14.0) lets an authenticated low-privileged user bypass per-bucket isolation by supplying a '../' bucket name, granting cross-bucket read, upload, and delete over all files regardless of owner or role. The flaw stems from an incomplete sanitization regex that strips dangerous characters but preserves dot sequences, which Flysystem then normalizes down to the storage root. No public exploit is identified at time of analysis, though a proof-of-concept gist is referenced; the issue was reported by VulnCheck and a vendor patch is available.

Technical ContextAI

The vulnerability lives in the api() method of modules/System/Controller/Buckets.php. Bucket names are sanitized with preg_replace('/[^a-zA-Z0-9-_\.]/','', $bucket), a denylist that explicitly permits the dot character, so '..' and '../' survive sanitization. The value is interpolated into a Flysystem virtual path 'uploads://buckets/{bucket}'. Because Flysystem's WhitespacePathNormalizer only raises PathTraversalDetected when a '..' has no preceding path component to consume, 'buckets/..' collapses to the empty string - the uploads storage root - silently. This is a textbook CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) where a broken input filter combines with a normalization edge case. Affected product per CPE is cpe:2.3:a:cockpit_hq:cockpit_cms across all versions prior to the fix; Cockpit CMS is a PHP-based headless/API-first content management system.

RemediationAI

Vendor-released patch: upgrade to Cockpit CMS 2.14.0 or later (fix commit dde2d1d74f5f4e11de42a298918ea8c9684f932c, released 2026-03-30). If immediate upgrade is not possible, apply the upstream fix by correcting bucket-name validation in modules/System/Controller/Buckets.php so dot sequences are rejected - replace the permissive preg_replace denylist with an allowlist that forbids '.' or explicitly blocks '..' before the value reaches the Flysystem path. As a compensating control, restrict access to the /system/buckets/api endpoint at the reverse proxy or application ACL layer to trusted administrators only, and audit/tighten account provisioning so low-privileged or self-registered users cannot reach the Bucket API (trade-off: may break legitimate bucket workflows for non-admin roles). Review upload storage for unauthorized file changes or deletions predating the patch. Reference the VulnCheck advisory (https://www.vulncheck.com/advisories/cockpit-cms-path-traversal-via-bucket-name-in-bucket-file-storage-api).