Executive brief
Cockpit CMS, a content management platform, contains a security flaw in its file storage system. An authenticated user with low-level permissions can bypass directory restrictions to view, upload, or delete files belonging to other users or administrators. This could lead to the exposure of sensitive data or the unauthorized modification of system files.
Technical details
A path traversal vulnerability exists in the api() method of modules/System/Controller/Buckets.php within Cockpit CMS. The application uses a regular expression for sanitization that fails to strip '..' and '../' sequences from bucket names. When these sequences are interpolated into a Flysystem path (uploads://buckets/{bucket}), the WhitespacePathNormalizer resolves the path to the storage root without triggering a traversal detection error. An authenticated attacker with low privileges can exploit this to list, upload, rename, or delete files in any bucket, including those restricted to administrators. The issue is fixed in version 2.14.0.
Affected products
- Cockpit HQ Cockpit CMS < 2.14.0
Timeline
- 2026-03-30: patched: Version 2.14.0 released
- 2026-06-04: disclosed: Reported to VulnCheck for coordinated disclosure
- 2026-07-13: advisory: NVD and VulnCheck advisories published
References
- https://gist.github.com/sermikr0/821c4edd3c34e98a62a50b07707785bd
- https://github.com/Cockpit-HQ/Cockpit/commit/dde2d1d74f5f4e11de42a298918ea8c9684f932c
- https://github.com/cockpit-hq/cockpit
- https://www.vulncheck.com/advisories/cockpit-cms-missing-authorization-in-bucket-file-storage-api
- https://www.vulncheck.com/advisories/cockpit-cms-path-traversal-via-bucket-name-in-bucket-file-storage-api