Cockpit CMS Missing Authorization in Bucket File Storage API

Executive Summary

CVE-2026-57855 is a missing authorization vulnerability in Cockpit CMS that affects versions prior to 2.14.0. The vulnerability exists in the Bucket file storage API, specifically in the /system/buckets/api endpoint.

The api() method in modules/System/Controller/Buckets.php executes bucket commands such as ls, upload, removefiles, rename, and createfolder without performing any access control list (ACL) or role checks. This means any authenticated user, regardless of their role, can perform all bucket operations on any named bucket, including those intended for admin use only.

• The vulnerability is classified as CWE-284 (Improper Access Control).
• It has a CVSS v4.0 BaseScore of 8.7 and a CVSS v3.1 BaseScore of 8.8, indicating high severity.

Additionally, there is a related Path Traversal vulnerability (CWE-22) that allows attackers to traverse outside intended bucket directories using ../ sequences in bucket names. This enables authenticated users to list, download, or delete files from restricted buckets by crafting malicious API requests.

Useful 0 Not Useful 0

Detection Guidance

To detect CVE-2026-57855 on your network or system, you can check for the presence of the vulnerable endpoint and test for unauthorized access to bucket operations.

• Verify the installed version of Cockpit CMS. The vulnerability affects versions prior to 2.14.0. You can check the version by inspecting the APP_VERSION constant in bootstrap.php or by running the following command if you have access to the server:
• grep 'APP_VERSION' /path/to/cockpit/bootstrap.php
• Test for unauthorized access to the Bucket API endpoint. Use a tool like curl to send authenticated requests to the /system/buckets/api endpoint and attempt operations like listing or uploading files to a restricted bucket. Example command:
• curl -X POST -H 'Content-Type: application/json' -H 'Authorization: Bearer YOUR_AUTH_TOKEN' -d '{"cmd":"ls","bucket":"admin-bucket"}' http://your-cockpit-instance/system/buckets/api
• If the response includes files or directories from the admin-bucket without proper authorization errors, the system is likely vulnerable.
• Check for path traversal attempts by crafting requests with malicious bucket names. Example command:
• curl -X POST -H 'Content-Type: application/json' -H 'Authorization: Bearer YOUR_AUTH_TOKEN' -d '{"cmd":"ls","bucket":"../admin-bucket"}' http://your-cockpit-instance/system/buckets/api
• If the response includes files from the admin-bucket, the system is vulnerable to path traversal.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have several serious impacts if you are using an affected version of Cockpit CMS (prior to 2.14.0).

• Unauthorized data access: Any authenticated user, even those with low-privilege roles like editors or content managers, can access files in buckets that are meant to be restricted to administrators. This compromises the confidentiality of sensitive data.
• Data integrity risks: Attackers can upload, modify, rename, or delete files in any bucket, leading to data corruption, loss, or unauthorized changes. This can disrupt operations and lead to incorrect or malicious content being served.
• Path traversal attacks: The vulnerability also includes a path traversal flaw, allowing attackers to access files outside the intended bucket directories. This can expose sensitive system files or data from other restricted buckets.
• Compliance violations: Unauthorized access to or modification of sensitive data can lead to violations of regulatory requirements, potentially resulting in legal or financial penalties.

Overall, the vulnerability poses significant risks to data security, system integrity, and compliance with organizational or regulatory policies.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can have serious implications for compliance with common standards and regulations, particularly those that mandate strict access controls and data protection.

• GDPR (General Data Protection Regulation): The vulnerability allows unauthorized access to sensitive data, which violates GDPR's requirements for data protection and access control. Under GDPR, organizations must ensure that personal data is processed securely and accessed only by authorized personnel. Unauthorized access or data breaches resulting from this vulnerability could lead to significant fines and legal consequences.
• HIPAA (Health Insurance Portability and Accountability Act): For organizations handling protected health information (PHI), this vulnerability poses a direct risk to HIPAA compliance. HIPAA requires strict access controls to ensure that only authorized individuals can access PHI. Unauthorized access or modification of PHI due to this vulnerability could result in violations, leading to penalties and reputational damage.
• Other standards: The vulnerability also impacts compliance with other standards such as ISO 27001, which requires organizations to implement access control measures to protect sensitive information. Failure to address this vulnerability could result in non-compliance and potential audit failures.

In summary, the missing authorization and path traversal vulnerabilities in Cockpit CMS can lead to unauthorized access and manipulation of sensitive data, directly conflicting with the requirements of GDPR, HIPAA, and other regulatory frameworks. Organizations using affected versions must apply the patch to mitigate these risks and maintain compliance.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate CVE-2026-57855, follow these immediate steps:

• Upgrade Cockpit CMS to version 2.14.0 or later. This version includes the fix for the missing authorization and path traversal vulnerabilities. You can download the latest version from the official Cockpit CMS GitHub repository.
• If upgrading is not immediately possible, apply the patch manually by updating the api() method in modules/System/Controller/Buckets.php to enforce ACL and role checks before executing bucket operations.
• Restrict access to the /system/buckets/api endpoint at the network level using a web application firewall (WAF) or reverse proxy rules until the upgrade or patch is applied.
• Review and audit bucket permissions and access logs to identify any unauthorized operations performed on restricted buckets.
• Monitor network traffic for suspicious requests targeting the /system/buckets/api endpoint, particularly those attempting path traversal or unauthorized bucket operations.

Useful 0 Not Useful 0