CVE-2026-58467: Cockpit CMS Path Traversal & Local File Inclusion Vulnerability

Technical summary

The vulnerability stems from improper validation of the PATH_INFO variable derived from REQUEST_URI when constructing filesystem paths. Cockpit CMS fails to implement containment checks before incorporating user-supplied path components into include() statements. An unauthenticated attacker can inject directory traversal sequences to navigate the filesystem hierarchy unrestricted. When the resolved path terminates in a .php extension, the application directly passes it to PHP's include() function, resulting in local file inclusion (LFI). This behavior is particularly dangerous on deployments using PHP's built-in development server or non-standard Nginx configurations that may not enforce typical web root boundaries.

Business impact

An attacker exploiting this vulnerability can read arbitrary files accessible to the web server process, including configuration files, database credentials, private keys, or source code containing business logic. In deployments where PHP execution is enabled on the traversed files, attackers can achieve remote code execution without authentication, leading to complete system compromise. This threatens data confidentiality, system integrity, and operational continuity, particularly for organizations using Cockpit CMS for content management or headless CMS scenarios.

Affected systems

Cockpit CMS through version 2.14.0 is vulnerable. The risk is elevated for deployments using the PHP built-in development server (php -S) or Nginx configurations that do not strictly enforce web root containment. Any instance exposed to untrusted networks without additional access controls is at risk.

Exploitability

Exploitation requires no authentication, no user interaction, and only a network connection to the affected application. An attacker can craft a malicious URL with path traversal sequences and submit it directly. The attack is straightforward: inject "../" sequences to traverse directories and target known files such as /etc/passwd, config.php, or other application-hosted PHP files. The CVSS score of 7.5 (HIGH) reflects the low attack complexity and high impact on confidentiality, though integrity and availability are not directly affected by the core path traversal itself.

Remediation

Upgrade Cockpit CMS to a patched version addressing path traversal validation. Until patching is possible, implement strict web application firewall rules to reject requests containing path traversal sequences (../, ..\, and encoded variants). Restrict file access permissions so the web server process runs with minimal privileges. For development environments, avoid using the PHP built-in server in production and deploy behind a properly configured reverse proxy that enforces web root containment.

Patch guidance

Consult the official Cockpit CMS release notes and security advisories to identify the minimum patched version that addresses CVE-2026-58467. Verify against the vendor advisory for specific version numbers and deployment instructions. After patching, validate that PATH_INFO handling includes path normalization and containment checks preventing directory traversal. Test with known traversal payloads (e.g., URLs containing ../) to confirm the vulnerability is resolved.

Detection guidance

Monitor web server access logs and web application firewall logs for requests containing path traversal patterns: %2e%2e%2f, ../, .., or backslash variants. Inspect REQUEST_URI and PATH_INFO parameters for suspicious sequences. Check for unusual file access attempts targeting sensitive files like config files, .php files outside the spaces directory, or system files. Correlate web server logs with PHP error logs to identify failed or successful include() attempts on unexpected paths.

Why prioritize this

This vulnerability merits immediate attention due to its HIGH severity, unauthenticated exploitability, and potential for full system compromise via local file inclusion. The low attack complexity means attackers require minimal resources or sophistication. Organizations running Cockpit CMS in public-facing or untrusted network environments should prioritize patching. The absence of KEV status does not diminish its urgency; path traversal combined with code inclusion is a well-understood attack vector actively exploited in the wild.

Risk score, explained

CVSS 3.1 score of 7.5 reflects: (1) Network attack vector—accessible over the network without special access; (2) Low attack complexity—straightforward URL manipulation; (3) No privileges or user interaction required; (4) Confidentiality impact rated HIGH due to unrestricted file read capability; (5) Integrity and availability marked as NONE since the core vulnerability enables disclosure, not modification or denial. This score appropriately captures the data exfiltration risk while noting that code execution depends on deployment specifics.

Frequently asked questions