CVE-2026-13533

Name of the Vulnerable Software and Affected Versions agentejo Cockpit CMS versions prior to 0.12.3

Description A path traversal issue exists in the htaccess Handler component. The Spyc::YAMLLoad() function processes the /config/config.yaml file in a way that allows remote attackers to make files or directories accessible. Path traversal is a technique used to access files and directories that are stored outside the web root folder.

Recommendations Update agentejo Cockpit CMS to a version newer than 0.12.2. Change the configuration settings to mitigate the risk. Restrict access to the /config/config.yaml file.