CVE-2026-13533: Cockpit CMS Remote File Access Vulnerability (v0.12.2)

Technical summary

CVE-2026-13533 affects the Spyc::YAMLLoad function within Cockpit CMS's htaccess handler, specifically in the /config/config.yaml component path. The vulnerability permits directory traversal or arbitrary file disclosure via remote, unauthenticated requests. The root cause involves insufficient input validation during YAML configuration parsing. The attack vector is network-based with low complexity and no user interaction required. CWE-425 (Direct Request) and CWE-552 (Files or Directories Accessible to External Parties) classify the exposure.

Business impact

This vulnerability can lead to unauthorized disclosure of sensitive configuration files, credentials stored in YAML configurations, database connection strings, API keys, and other system metadata. Organizations running Cockpit CMS may face data exfiltration, compliance violations, and secondary attack preparation if attackers obtain credentials or system architecture details. The low CVSS score reflects confidentiality risk only; integrity and availability remain unaffected, but exposure of configuration data can enable follow-on compromises.

Affected systems

Cockpit CMS versions through 0.12.2 are vulnerable. Organizations using this content management system, particularly older deployments that have not updated, require immediate assessment. Verify your installed version against vendor release notes. The vulnerability does not affect systems running patched or newer versions beyond 0.12.2.

Exploitability

Exploitation is straightforward: the attack requires no authentication, no user interaction, and can be executed remotely over the network with low complexity. Proof-of-concept code is publicly disclosed, lowering the barrier for opportunistic attacks. However, exploitation is confined to information disclosure; it does not provide code execution or denial-of-service capabilities.

Remediation

Upgrade Cockpit CMS to a version patched after 0.12.2. Review your deployment to confirm the current version and apply the latest security patch from the vendor. Until patching is feasible, restrict network access to the /config directory and surrounding administrative paths using firewall rules or web server configuration. Monitor access logs for suspicious requests targeting configuration files.

Patch guidance

Contact the Cockpit CMS vendor or review their official security advisories and release notes to identify and obtain the patched version beyond 0.12.2. Apply patches in a controlled test environment first to confirm compatibility with your site configuration and plugins. Given the vendor's lack of responsiveness noted in the public disclosure, prioritize upgrading or consider migrating to actively maintained CMS alternatives if support is a concern.

Detection guidance

Monitor for HTTP requests targeting /config/config.yaml or adjacent configuration paths, especially those with encoded path traversal sequences (%2e%2e) or unusual YAML syntax. Audit web server logs for unauthorized 200-status responses to configuration file paths from external IP addresses. Check file access logs for reads of config.yaml by the web server process outside normal operations. Implement web application firewall (WAF) rules to block requests attempting to access configuration directories.

Why prioritize this

Although the CVSS score is medium (5.3), the public disclosure and low exploitation barrier warrant prompt attention. Configuration file exposure directly enables credential theft and infrastructure reconnaissance. The lack of vendor engagement suggests patches may be delayed; rapid assessment and mitigation planning is critical to prevent data loss in active deployments.

Risk score, explained

The CVSS 5.3 score reflects low-complexity, unauthenticated remote access leading to confidential information disclosure. No integrity or availability impact occurs from this vulnerability alone. The score would be elevated if the configuration contained highly sensitive secrets or if the affected system were internet-facing and frequently scanned. Public exploit availability and vendor non-responsiveness increase operational risk beyond the base score.

Frequently asked questions