Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-07-02T20:04:56 cockpit: Cockpit CMS: Arbitrary file read and code execution via path traversal 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CWE-22

Cockpit CMS through 2.14.0 contains a path traversal and local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files or execute PHP files by including unvalidated PATH_INFO derived from REQUEST_URI in filesystem path construction without containment checks. Attackers can inject dot-dot sequences into the URL to traverse outside the designated spaces directory, and when the resolved path ends with a .php extension, the application passes it to include(), enabling local file inclusion on deployments using the PHP built-in server or certain non-default Nginx configurations.

A flaw was found in Cockpit CMS. This vulnerability, a path traversal and local file inclusion, allows an unauthenticated attacker to read arbitrary files or execute PHP files. By manipulating the URL, an attacker can bypass security checks and access restricted directories. This could lead to unauthorized information disclosure or the execution of malicious code on affected systems.

This Important flaw in Cockpit CMS allows unauthenticated attackers to perform path traversal and local file inclusion, enabling them to read arbitrary files or execute PHP files. This is due to improper validation of `PATH_INFO` in the `REQUEST_URI`, which can be exploited on systems utilizing the PHP built-in server or certain non-default Nginx configurations. Successful exploitation could lead to unauthorized information disclosure or arbitrary code execution in some cases. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Red Hat Enterprise Linux 10 Affected cockpit Red Hat Enterprise Linux 7 Out of support scope cockpit Red Hat Enterprise Linux 8 Affected cockpit Red Hat Enterprise Linux 9 Affected cockpit https://www.cve.org/CVERecord?id=CVE-2026-58467 https://nvd.nist.gov/vuln/detail/CVE-2026-58467 https://github.com/cockpit-project/cockpit/releases/tag/364 https://github.com/geo-chen/oss/blob/main/cockpit.md https://www.vulncheck.com/advisories/cockpit-cms-364-path-traversal-local-file-inclusion-via-index-php