CVE-2026-57856highCWE-22

CVE-2026-57856: fallo de gravedad alta en Cockpit CMS

Cockpit CMS Path Traversal via Bucket Name in Bucket File Storage API

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Cockpit CMS

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.7epss 0.5%
Cockpit CMS contains a path traversal vulnerability in the Bucket file storage API (/system/buckets/api). The api() method in modules/System/Controller/Buckets.php sanitizes the bucket name with preg_replace('/[^a-zA-Z0-9-_\\.]/','', $bucket), which permits '..' and '../' sequences. The sanitized value is interpolated into a Flysystem path as uploads://buckets/{bucket}. Flysystem's WhitespacePathNormalizer resolves 'buckets/..' to the empty string (the uploads storage root) without raising PathTraversalDetected because the '..' has a preceding component to consume. An authenticated low-privileged user can send a crafted request with a '../' bucket name to list, upload, and delete files across all buckets, including those belonging to other users or roles
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
Cockpit HQ · Cockpit CMS
CVEs relacionadas — Cockpit CMS

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-73680HIGHCockpit CMS 2.14.0 Authenticated Command Injection via FFmpeg FilenameEPSS 2.8%CVE-2026-57855HIGHCockpit CMS Missing Authorization in Bucket File Storage APIEPSS 0.5%