CVE-2026-57855highCWE-284

CVE-2026-57855: fallo de gravedad alta en Cockpit CMS

Cockpit CMS Missing Authorization in Bucket File Storage API

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Cockpit CMS

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.7epss 0.5%
Cockpit CMS contains a missing authorization vulnerability in the Bucket file storage API (/system/buckets/api). The api() method in modules/System/Controller/Buckets.php executes bucket commands (ls, upload, removefiles, rename, createfolder) without performing any ACL or role check. Any authenticated user, regardless of role, can perform all bucket operations on any named bucket, including buckets intended for admin use only.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
Cockpit HQ · Cockpit CMS
CVEs relacionadas — Cockpit CMS

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-73680HIGHCockpit CMS 2.14.0 Authenticated Command Injection via FFmpeg FilenameEPSS 2.8%CVE-2026-57856HIGHCockpit CMS Path Traversal via Bucket Name in Bucket File Storage APIEPSS 0.5%