CVE-2026-58467: Cockpit CMS 2.14.0 - Path Traversal Local File Inclusion via index.php
Cockpit CMS through 2.14.0 contains a path traversal and local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files or execute PHP files by including unvalidated PATHINFO derived from REQUESTURI in filesystem path construction without containment checks. Attackers can inject dot-dot sequences into the URL to traverse outside the designated spaces directory, and when the resolved path ends with a .php extension, the application passes it to include(), enabling local file inclusion on deployments using the PHP built-in server or certain non-default Nginx configurations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Cockpit CMSto a version that resolves this vulnerability.Fixed in 2.14.0 - Compensating control
Ensure URL handling enforces containment so that PATH_INFO/REQUEST_URI derived paths cannot traverse outside the designated spaces directory (block dot-dot sequences and validate resolved paths stay within the intended directory), especially for PHP built-in server deployments and non-default Nginx configurations.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-58467?
CVE-2026-58467 has a high severity rating of 7.5.
How do I fix CVE-2026-58467?
To mitigate CVE-2026-58467, upgrade Cockpit CMS to version 364 or later.
What kind of attack does CVE-2026-58467 enable?
CVE-2026-58467 enables unauthenticated attackers to perform path traversal and local file inclusion attacks.
What are the consequences of exploiting CVE-2026-58467?
Exploiting CVE-2026-58467 can allow attackers to read arbitrary files or execute PHP files on the server.
Which versions of Cockpit CMS are affected by CVE-2026-58467?
CVE-2026-58467 affects all versions of Cockpit CMS prior to version 364.