CVE-2026-13533: Cockpit CMS Path Traversal Vulnerability

CVE-2026-13533 Overview

CVE-2026-13533 is a configuration exposure vulnerability affecting agentejo Cockpit CMS through version 0.12.2. The flaw resides in the Spyc::YAMLLoad function processing the /config/config.yaml file within the htaccess Handler component. Attackers can access files or directories that should be restricted, exposing configuration data over the network without authentication. The exploit has been publicly disclosed and is available for use. The vendor was contacted about this disclosure but did not respond, leaving affected instances without an official patch. This weakness is categorized under [CWE-425] Direct Request (Forced Browsing).

Critical Impact
Unauthenticated remote attackers can read sensitive Cockpit CMS configuration files over the network, exposing application settings and potentially credentials or secrets stored in config.yaml.

Affected Products

agentejo Cockpit CMS versions up to and including 0.12.2
Deployments serving the /config/config.yaml path via web server
Installations relying on the default htaccess Handler configuration

Discovery Timeline

2026-06-29 - CVE-2026-13533 published to NVD
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-13533

Vulnerability Analysis

Cockpit CMS ships a YAML-based configuration file at /config/config.yaml, parsed at runtime by the Spyc::YAMLLoad function. The htaccess Handler component is responsible for restricting direct HTTP access to sensitive paths inside the application directory. When these access controls fail or are not enforced by the underlying web server, the raw YAML file becomes reachable via a direct HTTP request. An unauthenticated remote attacker can request the configuration URL and retrieve its contents in plaintext.

Because config.yaml frequently holds application secrets, database connection strings, and administrative parameters, disclosure of this file provides attackers with material for follow-on attacks. The vulnerability requires no user interaction and no privileges, making opportunistic scanning viable.

Root Cause

The root cause is improper access control on static configuration assets shipped with Cockpit CMS. The htaccess Handler does not reliably block direct requests to /config/config.yaml, and the file is served as static content by the web server. This maps to [CWE-425] Direct Request, where a protected resource is reachable by requesting the exact path.

Attack Vector

Exploitation is performed over the network by issuing an HTTP GET request to the vulnerable path on a Cockpit CMS instance. No authentication, session, or user interaction is required. The response returns the YAML configuration contents, which the attacker parses offline. Public exploit material is available via a GitHub Gist Exploit Code reference and the VulDB CVE-2026-13533 record.

No verified code example is available for reproduction. Technical details are referenced through the published advisories.

Detection Methods for CVE-2026-13533

Indicators of Compromise

HTTP GET requests to /config/config.yaml or similar paths under the Cockpit CMS /config/ directory from external sources
Successful 200 OK responses returning Content-Type: text/yaml or text/plain from a Cockpit CMS host
Requests originating from scanning tools or unfamiliar user agents targeting known Cockpit CMS install paths

Detection Strategies

Review web server access logs for direct requests to YAML configuration paths and flag any that return non-403 status codes
Deploy web application firewall rules that block or alert on requests to *.yaml and *.yml under /config/
Correlate outbound reconnaissance patterns targeting Cockpit CMS with subsequent access attempts to administrative endpoints

Monitoring Recommendations

Ingest web server and reverse proxy logs into a centralized analytics platform for anomaly detection on static configuration paths
Alert on repeated 200 responses for requests to /config/, /data/, or other Cockpit CMS internal directories
Track authentication events following any successful configuration file retrieval to detect credential reuse attempts

How to Mitigate CVE-2026-13533

Immediate Actions Required

Block external access to the /config/ directory at the web server or reverse proxy layer
Rotate any secrets, API keys, or database credentials stored in config.yaml if the instance was exposed to the internet
Audit web server logs for prior successful retrieval of the configuration file

Patch Information

The vendor did not respond to the disclosure and no official patch is currently published. Administrators must apply configuration hardening and workarounds until a fixed release is available. Track updates via the VulDB Vulnerability Report.

Workarounds

Add explicit deny rules in the web server configuration for *.yaml, *.yml, and the /config/ path
Relocate the Cockpit CMS config directory outside the web root where the server configuration permits it
Restrict inbound access to the CMS with IP allowlists or authenticated reverse proxy access
Store secrets in environment variables instead of config.yaml where the application supports it

bash

# Apache: deny direct access to YAML configuration files
<FilesMatch "\.(ya?ml)$">
    Require all denied
</FilesMatch>

<Directory "/var/www/cockpit/config">
    Require all denied
</Directory>

# Nginx equivalent
# location ~* \.(ya?ml)$ { deny all; return 403; }
# location ^~ /config/ { deny all; return 403; }