Executive brief
Cockpit CMS, a content management system used to manage website data, contains a security flaw that allows unauthorized individuals to access sensitive files on the server. By sending a specially crafted web request, an attacker can bypass security restrictions to read internal system files or potentially execute malicious code. This could lead to the theft of sensitive configuration data or a full compromise of the web server.
Technical details
A path traversal and local file inclusion (LFI) vulnerability exists in Cockpit CMS prior to version 364. The application uses unvalidated PATH_INFO derived from the REQUEST_URI to construct filesystem paths without proper containment checks. An unauthenticated remote attacker can use dot-dot-slash (../) sequences to traverse outside the intended directory. If the resolved path ends in a .php extension, the application passes it to the PHP include() function, leading to code execution on systems using the PHP built-in server or specific Nginx configurations. The vulnerability is tracked as CWE-22.
Affected products
- cockpit-project Cockpit CMS before 364
Timeline
- 2026-06-23: patched: Release 364 published
- 2026-07-02: advisory: NVD and VulnCheck advisories published