CVE-2026-57856: Cockpit CMS Path Traversal via Bucket Name in Bucket File Storage API
Cockpit CMS contains a path traversal vulnerability in the Bucket file storage API (/system/buckets/api). The api() method in modules/System/Controller/Buckets.php sanitizes the bucket name with pregreplace('/[^a-zA-Z0-9-\\.]/','', $bucket), which permits '..' and '../' sequences. The sanitized value is interpolated into a Flysystem path as uploads://buckets/{bucket}. Flysystem's WhitespacePathNormalizer resolves 'buckets/..' to the empty string (the uploads storage root) without raising PathTraversalDetected because the '..' has a preceding component to consume. An authenticated low-privileged user can send a crafted request with a '../' bucket name to list, upload, and delete files across all buckets, including those belonging to other users or roles
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update modules/System/Controller/Buckets.php so that the bucket name used in Flysystem path interpolation does not allow path traversal; specifically do not permit '..' or '../' (current preg_replace('/[^a-zA-Z0-9-_\.]/','', $bucket) permits these sequences, leading to uploads://buckets/{bucket} resolving to the uploads storage root).
Cockpit CMS Bucket file storage API (modules/System/Controller/Buckets.php / system buckets API) Bucket name sanitization = Reject bucket names containing path traversal sequences ('..' or '../')
Event History
Frequently Asked Questions
What is the severity of CVE-2026-57856?
CVE-2026-57856 has a high severity rating of 8.8.
What is the risk associated with CVE-2026-57856?
The risk associated with CVE-2026-57856 is classified as 79.
How do I fix CVE-2026-57856?
To mitigate CVE-2026-57856, ensure proper sanitization of bucket names to block path traversal sequences.
What component is affected by CVE-2026-57856?
CVE-2026-57856 affects the Bucket file storage API in Cockpit CMS.
What type of vulnerability is CVE-2026-57856?
CVE-2026-57856 is classified as a Path Traversal vulnerability.