CVE-2026-38993: Cockpit Path Traversal Vulnerability

CVE-2026-38993 Overview

CVE-2026-38993 is a directory traversal vulnerability affecting Cockpit CMS version 2.13.5 and earlier. This security flaw exists in the Buckets component and allows authenticated attackers to write files to arbitrary locations within the uploads directory or overwrite existing assets with malicious versions. The vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

Critical Impact

Authenticated attackers can leverage this directory traversal flaw to write arbitrary files within the uploads directory, potentially enabling further attacks such as web shell deployment, configuration tampering, or content defacement.

Affected Products

• Cockpit CMS version 2.13.5 and earlier
• Cockpit CMS Buckets component

Discovery Timeline

• 2026-04-29 - CVE-2026-38993 published to NVD
• 2026-04-29 - Last updated in NVD database

Technical Details for CVE-2026-38993

Vulnerability Analysis

This directory traversal vulnerability resides in the Buckets component of Cockpit CMS. The flaw allows authenticated users to manipulate file path parameters to write files outside the intended directory structure, specifically within the uploads directory. This type of vulnerability occurs when user-supplied input containing path traversal sequences (such as ../) is not properly sanitized before being used in file system operations.

The vulnerability requires authentication to exploit, which limits the attack surface to users who have valid credentials to the Cockpit CMS instance. However, once authenticated, an attacker can leverage this flaw to write arbitrary files or overwrite existing assets with malicious content.

Root Cause

The root cause is improper input validation in the Buckets component's file handling functionality. The application fails to adequately sanitize user-supplied file paths, allowing path traversal sequences to escape the intended directory boundaries. This occurs because the file path parameter is not properly normalized or validated against a whitelist of allowed directories before being used in file write operations.

Attack Vector

The attack is conducted over the network by an authenticated user. The attacker crafts malicious requests to the Buckets component containing path traversal sequences (e.g., ../) in file path parameters. These sequences allow the attacker to navigate out of the intended directory and write files to arbitrary locations within the uploads directory structure.

The vulnerability manifests when processing file upload or asset management requests through the Buckets component. An attacker with valid authentication credentials can manipulate the destination path parameter to include directory traversal sequences, bypassing the intended file storage restrictions. For detailed technical information, refer to the Felsec Multi-Vulnerability Report.

Detection Methods for CVE-2026-38993

Indicators of Compromise

• Unexpected files appearing in the uploads directory or subdirectories
• File system activity showing path traversal patterns such as ../ or ..\ in request logs
• Modified asset files with unexpected content or timestamps
• Web server access logs containing encoded path traversal sequences (e.g., %2e%2e%2f)

Detection Strategies

• Monitor web application logs for requests to the Buckets component containing path traversal sequences
• Implement file integrity monitoring on the uploads directory to detect unauthorized file modifications
• Review access logs for suspicious authenticated user activity targeting file management endpoints
• Deploy web application firewall (WAF) rules to detect and block path traversal patterns

Monitoring Recommendations

• Enable detailed logging for all file operations within the Cockpit CMS application
• Set up alerts for file creation or modification events in unexpected locations within the uploads directory
• Monitor for rapid or bulk file operations that may indicate automated exploitation attempts
• Track authenticated user sessions for anomalous behavior patterns

How to Mitigate CVE-2026-38993

Immediate Actions Required

• Upgrade Cockpit CMS to version 2.14.0 or later immediately
• Review the uploads directory for any unauthorized or suspicious files
• Audit user accounts and revoke access for any compromised or unnecessary credentials
• Implement additional access controls to restrict who can access the Buckets component

Patch Information

The vulnerability has been addressed in Cockpit CMS version 2.14.0. Organizations running affected versions should upgrade immediately. Release notes and patch details are available in the GitHub Cockpit Release Notes.

Workarounds

• Restrict access to the Buckets component to only trusted administrative users until patching is complete
• Implement web application firewall rules to block requests containing path traversal sequences
• Apply strict file system permissions to limit the scope of potential file write operations
• Consider temporarily disabling the Buckets component if it is not critical to operations

# Configuration example - Restrict Buckets access and implement monitoring
# Add to your web server configuration to block path traversal attempts
# Apache example:
RewriteEngine On
RewriteCond %{REQUEST_URI} \.\./ [OR]
RewriteCond %{REQUEST_URI} \.\.\\
RewriteRule .* - [F,L]

# Set restrictive permissions on uploads directory
chmod 750 /path/to/cockpit/storage/uploads
chown www-data:www-data /path/to/cockpit/storage/uploads