CVE-2026-57856: Cockpit CMS Path Traversal Vulnerability

CVE-2026-57856 Overview

Cockpit CMS contains a path traversal vulnerability [CWE-22] in the Bucket file storage API exposed at /system/buckets/api. The api() method in modules/System/Controller/Buckets.php applies an insufficient sanitizer that strips only characters outside a-zA-Z0-9-_., allowing .. and ../ sequences to survive. The sanitized bucket name is then interpolated into a Flysystem path as uploads://buckets/{bucket}. An authenticated low-privileged user can traverse to the uploads storage root and manipulate files across all buckets.

Critical Impact
An authenticated low-privileged attacker can list, upload, and delete files in buckets belonging to other users or roles, breaking cross-tenant file isolation in Cockpit CMS.

Affected Products

Cockpit CMS versions prior to 2.14.0
modules/System/Controller/Buckets.php component
Deployments exposing /system/buckets/api to authenticated users

Discovery Timeline

2026-07-13 - CVE-2026-57856 published to the National Vulnerability Database (NVD)
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-57856

Vulnerability Analysis

The flaw resides in the Bucket file storage API of Cockpit CMS. The api() method sanitizes the bucket parameter using preg_replace('/[^a-zA-Z0-9-_\.]/','', $bucket). The regular expression explicitly permits the dot character, so payloads such as .. and ../ pass through unchanged.

The sanitized value is concatenated into a Flysystem virtual path of the form uploads://buckets/{bucket}. Flysystem's WhitespacePathNormalizer resolves the intermediate segment buckets/.. to an empty string, which points to the root of the uploads storage. Because the .. has a preceding path component to consume, the normalizer does not raise PathTraversalDetected.

The resulting behavior lets an authenticated user reach files outside their intended bucket scope. Combined with the missing authorization check on this endpoint, the endpoint effectively exposes all bucket contents to any low-privileged account.

Root Cause

The root cause is a permissive input filter that does not remove traversal metacharacters combined with a path normalizer whose safety check is bypassed when a valid component precedes the traversal sequence. Neither layer enforces that the resolved path stays within the intended buckets/{bucket}/ directory.

Attack Vector

Exploitation requires network access to the Cockpit administrative API and a valid low-privileged account. The attacker submits a crafted request to /system/buckets/api with a bucket parameter such as ../ or foo/.., then invokes list, upload, or delete actions to operate on files across the entire uploads storage root.

php

// Patch reference: version bump in bootstrap.php
<?php

-const APP_VERSION = '2.13.5';
+const APP_VERSION = '2.14.0';

if (!defined('APP_ADMIN')) define('APP_ADMIN', false);
if (!defined('APP_CLI')) define('APP_CLI', PHP_SAPI == 'cli');

Source: GitHub Commit dde2d1d

Detection Methods for CVE-2026-57856

Indicators of Compromise

HTTP requests to /system/buckets/api where the bucket parameter contains .., ../, or %2e%2e%2f sequences.
Unexpected file creation, modification, or deletion events at the root of the uploads storage rather than inside a specific bucket subdirectory.
Access to files under uploads/buckets/ by user accounts that do not own the target bucket.

Detection Strategies

Inspect Cockpit application and web server access logs for POST requests to /system/buckets/api with traversal payloads in the bucket field.
Baseline normal bucket usage per user role and alert on any account interacting with buckets outside its assignment.
Monitor the filesystem or object store backing the uploads adapter for writes and deletes originating outside expected bucket paths.

Monitoring Recommendations

Enable verbose logging on the Cockpit System/Buckets controller and forward events to a central SIEM for correlation.
Track authentication events for low-privileged accounts that suddenly perform bulk bucket operations.
Alert on any Flysystem error or warning referencing normalized empty paths under the uploads adapter.

How to Mitigate CVE-2026-57856

Immediate Actions Required

Upgrade Cockpit CMS to version 2.14.0 or later, which contains the fix referenced in commit dde2d1d74f5f4e11de42a298918ea8c9684f932c.
Restrict access to /system/buckets/api at the web server or reverse proxy layer to trusted administrative networks where feasible.
Audit existing bucket contents for unauthorized additions, modifications, or deletions.

Patch Information

The vendor addressed the issue in Cockpit CMS 2.14.0. Review the GitHub commit details and the Vulncheck path traversal advisory for full technical context. A related missing authorization advisory covers the corresponding access-control weakness in the same endpoint.

Workarounds

Block requests to /system/buckets/api where the bucket parameter contains . sequences using a web application firewall (WAF) rule until the patch is applied.
Temporarily disable the Buckets feature or revoke the bucket permission from non-administrative roles.
Enforce stricter server-side validation by rejecting bucket names that do not match a strict allowlist such as ^[a-zA-Z0-9_-]+$.

bash

# Example WAF rule (ModSecurity) to block traversal in bucket parameter
SecRule REQUEST_URI "@beginsWith /system/buckets/api" \
    "chain,phase:2,deny,status:403,id:1026057856,\
     msg:'CVE-2026-57856 Cockpit bucket path traversal attempt'"
  SecRule ARGS:bucket "@rx (\.\.|/|%2e%2e|%2f)" "t:none,t:urlDecode"