CVE-2026-57856highCWE-22

CVE-2026-57856: falha de alta gravidade em Cockpit CMS

Cockpit CMS Path Traversal via Bucket Name in Bucket File Storage API

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Cockpit CMS

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.7epss 0.5%
Cockpit CMS contains a path traversal vulnerability in the Bucket file storage API (/system/buckets/api). The api() method in modules/System/Controller/Buckets.php sanitizes the bucket name with preg_replace('/[^a-zA-Z0-9-_\\.]/','', $bucket), which permits '..' and '../' sequences. The sanitized value is interpolated into a Flysystem path as uploads://buckets/{bucket}. Flysystem's WhitespacePathNormalizer resolves 'buckets/..' to the empty string (the uploads storage root) without raising PathTraversalDetected because the '..' has a preceding component to consume. An authenticated low-privileged user can send a crafted request with a '../' bucket name to list, upload, and delete files across all buckets, including those belonging to other users or roles
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
Cockpit HQ · Cockpit CMS
CVEs relacionadas — Cockpit CMS

No mesmo produto, das mais perigosas para as menos.

CVE-2026-73680HIGHCockpit CMS 2.14.0 Authenticated Command Injection via FFmpeg FilenameEPSS 2.8%CVE-2026-57855HIGHCockpit CMS Missing Authorization in Bucket File Storage APIEPSS 0.5%