Path Traversal and LFI in Cockpit CMS

Executive Summary

CVE-2026-58467 is a path traversal and local file inclusion vulnerability in Cockpit CMS versions before release 364. It occurs because the application constructs filesystem paths using the PATH_INFO derived from the REQUEST_URI without properly validating or restricting path traversal sequences.

An unauthenticated attacker can inject dot-dot sequences ("..") into the URL to traverse outside the intended '.spaces' directory and read arbitrary files on the server. If the resolved path ends with a .php extension, the application includes that file using PHP's include() function, which can lead to local file inclusion or remote code execution in certain server configurations.

This vulnerability is fully exploitable in environments using PHP's built-in development server and potentially exploitable in some non-default Nginx setups, but not in default Apache deployments due to URL normalization.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by attempting to access files outside the intended '.spaces' directory using crafted URLs that include path traversal sequences such as '..'. For example, sending HTTP requests with URLs containing '../../' sequences targeting sensitive files like /etc/passwd can reveal if the server improperly serves these files.

You can use command-line tools like curl or wget to test for this vulnerability by requesting URLs that include path traversal payloads.

• curl -i http://yourserver/index.php/../../../../../../etc/passwd
• curl -i http://yourserver/index.php/../../../../../../var/www/cockpit/.spaces/somefile.php

If the server responds with the contents of these files or executes PHP files included via such paths, it indicates the presence of the vulnerability.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an unauthenticated attacker to read any file on the server that the web server process has access to, potentially exposing sensitive information such as configuration files, credentials, or other private data.

Additionally, if the attacker can cause the application to include a PHP file, they may execute arbitrary PHP code on the server, leading to local file inclusion or remote code execution. This can compromise the entire server, allowing attackers to take control, modify data, or disrupt services.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows unauthenticated attackers to read arbitrary files on the server, potentially exposing sensitive or personal data stored within the affected Cockpit CMS instance.

Such unauthorized data exposure could lead to non-compliance with data protection regulations like GDPR or HIPAA, which require strict controls over access to personal and sensitive information.

Additionally, the possibility of local file inclusion and remote code execution increases the risk of further compromise, which may violate security requirements mandated by these standards.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include updating Cockpit CMS to version 364 or later, where the vulnerability has been fixed by adding proper path containment checks using realpath() to ensure file paths remain within the designated '.spaces' directory.

If updating is not immediately possible, consider the following temporary measures:

• Avoid using the PHP built-in development server in production environments, as it does not normalize path traversal sequences.
• Review and adjust Nginx configurations to ensure that PATH_INFO is properly normalized and that 'merge_slashes' is enabled to prevent raw URI path traversal.
• Implement web application firewall (WAF) rules to block requests containing suspicious path traversal patterns like '../'.

Monitoring logs for unusual requests with path traversal attempts can also help in early detection and response.

Useful 0 Not Useful 0