Which versions of Cockpit CMS are affected by CVE-2026-58467?

Cockpit CMS before release 364 contains an unauthenticated remote file disclosure and local file inclusion vulnerability (CVSS 8.2) that allows attackers to read configuration files, credentials, and…. A patch is available.

Is there a public PoC exploit available for CVE-2026-58467?

Yes, a public proof-of-concept exploit is available for CVE-2026-58467. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-58467?

Within 24 hours: Inventory all Cockpit CMS installations and identify those running versions prior to release 364. Within 7 days: Upgrade all instances to Cockpit CMS release 364 or later and review web server logs (REQUEST_URI patterns, file access attempts to config directories). Within 30 days: Conduct forensic audit of vulnerable systems to identify unauthorized file reads or inclusions; rotate all credentials that may have been exposed in configuration files or application code.

Cockpit CMS CVE-2026-58467

Q: What is the CVSS score of CVE-2026-58467?

CVE-2026-58467 has a CVSS 4.0 base score of 8.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-41436 HIGH

Path Traversal (CWE-22)

2026-07-02 VulnCheck

GHSA-f6g9-3r3j-32rg

Path Traversal Nginx PHP Cockpit Red Hat

8.2

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.9 MEDIUM

Unauthenticated network attack (AV:N/PR:N/UI:N) but exploitation depends on non-default server config, so AC:H; primary impact is arbitrary file disclosure (C:H) with no confirmed integrity/availability effect.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 20:36 vuln.today

CVE Published

Jul 02, 2026 - 20:04 cve.org

HIGH 8.2

DescriptionCVE.org

Cockpit CMS before release 364 contains a path traversal and local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files or execute PHP files by including unvalidated PATH_INFO derived from REQUEST_URI in filesystem path construction without containment checks. Attackers can inject dot-dot sequences into the URL to traverse outside the designated spaces directory, and when the resolved path ends with a .php extension, the application passes it to include(), enabling local file inclusion on deployments using the PHP built-in server or certain non-default Nginx configurations.

Articles & Coverage 1

News 3 New Nginx Vulnerabilities - 2 Critical, 1 With POC Jul 03, 2026

AnalysisAI

Arbitrary file disclosure and PHP local file inclusion in Cockpit CMS before release 364 lets unauthenticated remote attackers read files outside the web root and, on certain server setups, cause the application to include() attacker-chosen .php files. The flaw stems from unvalidated PATH_INFO (derived from REQUEST_URI) being used to build filesystem paths without containment checks. Publicly available exploit code exists; it is not listed in CISA KEV and no EPSS score was provided.

Technical ContextAI

Cockpit CMS is a self-hosted, open-source headless content management system written in PHP (cpe:2.3:a:cockpit-project:cockpit). The bug is a classic CWE-22 path traversal: the front controller (index.php) constructs a filesystem path by concatenating server-supplied PATH_INFO onto the designated 'spaces' directory, trusting REQUEST_URI without normalizing or verifying that the resolved path stays within the intended base directory. Because '../' (dot-dot) sequences are not stripped or rejected, the resolved target can point anywhere on disk, and when the target ends in .php the value is handed to PHP's include(), turning a read primitive into local file inclusion. Whether PATH_INFO reaches the application in an exploitable form depends on how the request is routed, which is why the PHP built-in server and specific non-default Nginx configurations are called out - the CVSS 4.0 AT:P (attack requirement) metric encodes this deployment dependency.

RemediationAI

Vendor-released patch: upgrade to Cockpit CMS release 364 or later (https://github.com/cockpit-project/cockpit/releases/tag/364), which adds containment checks on the PATH_INFO-derived path. If immediate upgrade is not possible, stop serving Cockpit via the PHP built-in server in production and review the Nginx config: ensure requests are routed through a strict location block that does not pass raw PATH_INFO/REQUEST_URI into index.php, and avoid the 'try_files ... /index.php$is_args$args' style patterns that reconstruct path info - the trade-off is you must test that legitimate space/route URLs still resolve. As additional compensating controls, place the application behind a WAF or reverse-proxy rule that blocks encoded and literal dot-dot ('../', '%2e%2e') sequences and requests whose path resolves to a .php outside the app root (may break edge cases that legitimately use encoded characters), and restrict network exposure of the admin interface to trusted networks. Consult the VulnCheck advisory above for exploitation specifics before validating mitigations.