Cockpit CMS EUVD-2026-40030

No vendor-released patch has been identified at time of analysis; the vendor (agentejo) did not respond to disclosure. As a primary mitigation, restrict HTTP access to the /config/ directory at the web server level - for Apache, add an explicit Deny rule in the main server configuration (not relying on .htaccess alone, given the htaccess Handler is the affected component): use a Directory directive with 'Require all denied' to block external access to /config/config.yaml and sibling paths. For nginx deployments, add a 'location ~ /config/ { deny all; }' block. Operators should also consider placing the Cockpit config directory outside the web root entirely and updating the application's config path reference - this removes reliance on .htaccess for protection. If upgrading or patching is not possible, isolating the Cockpit CMS instance behind a WAF rule blocking path traversal patterns (../, %2e%2e) targeting /config/ provides additional defense. Monitor access logs for unexpected requests to /config/ paths. Exploit code is publicly available at https://gist.github.com/nov-1337/3eb0a06c602ced9c3b11b675b53947da - review it to understand exact request patterns and tune blocking rules accordingly.