Cockpit CMS CVE-2026-58467

Requires that the Cockpit CMS deployment expose index.php via the PHP built-in server OR a non-default Nginx configuration that forwards unsanitized PATH_INFO/REQUEST_URI into the application - this is the explicit prerequisite from the description and the reason CVSS 4.0 sets AT:P. No authentication and no user interaction are needed (PR:N/UI:N), and the attack is over the network (AV:N), so any reachable instance on a vulnerable server config can be hit by an unauthenticated remote attacker. Limiting factors: default/hardened stacks (e.g., Apache or Nginx with PHP-FPM that do not pass raw PATH_INFO) may not be exploitable, PHP execution is limited to including .php files already present on disk (no arbitrary upload primitive described), and the rated impact is confidentiality-only.

The vendor CVSS 4.0 score is 8.2 (High) with vector AV:N/AC:L/AT:P/PR:N/UI:N and confidentiality-only impact (VC:H, VI:N, VA:N), meaning the assessors rated this primarily as unauthenticated remote file disclosure rather than full code execution - LFI here includes existing .php files, not attacker-uploaded code, so it lacks a straightforward RCE integrity/availability impact. The single most important qualifier is AT:P: exploitation is gated on the deployment using the PHP built-in server or particular non-default Nginx configs, so default hardened Apache/PHP-FPM stacks may not be exploitable, making this targeted at misconfigured or development-style deployments rather than universally exploitable. Public exploit code exists (raising practical risk), but it is NOT in CISA KEV and no EPSS probability was supplied, so there is no evidence of active, widespread exploitation at time of analysis. Net: a real, patch-now issue for exposed Cockpit instances on the affected server configurations, but the config dependency meaningfully narrows the blast radius versus the raw 8.2.

An attacker enumerates an internet-exposed Cockpit CMS instance and sends a crafted request to index.php with dot-dot sequences in the trailing path (PATH_INFO), traversing out of the spaces directory to read sensitive files such as configuration or credential files. Where the deployment routes PATH_INFO into the app and the resolved path ends in .php, the attacker points include() at an existing server-side PHP file to trigger local file inclusion; public exploit code for this technique already exists, lowering the skill needed.