Executive brief
Agentejo Cockpit CMS, a content management system, contains a security flaw where sensitive configuration files are stored in a publicly accessible location. An attacker can remotely access these files to steal database credentials, SMTP login details, API keys, and other private system settings. This could lead to a full compromise of the website's data and connected services.
Technical details
A Direct Request (Forced Browsing) vulnerability exists in Agentejo Cockpit CMS v1 through version 0.12.2. The application stores its primary configuration file at /config/config.yaml within the webroot. While the default .htaccess file contains a directive to block .yaml files, it is directory-scoped to the root and does not recursively protect subdirectories like /config/. Furthermore, Nginx deployments lack any default protection as they do not support .htaccess. An unauthenticated remote attacker can fetch the raw YAML file, which contains SMTP credentials, API keys, and database settings. The vendor has not released a patch for v1, though v2 is reportedly not affected.
Affected products
- agentejo Cockpit CMS up to 0.12.2
Timeline
- 2026-05-28: disclosed: Vulnerability discovered and vendor notified.
- 2026-06-29: advisory: CVE published via VulDB/NVD.