CVE-2026-58467

Name of the Vulnerable Software and Affected Versions Cockpit CMS versions prior to 364

Description Unauthenticated attackers can read arbitrary files or execute PHP files due to a path traversal and local file inclusion issue. The application fails to perform containment checks when constructing filesystem paths using unvalidated PATH INFO derived from the REQUEST URI. By injecting dot-dot sequences into the URL, an attacker can traverse outside the designated spaces directory. If the resolved path ends with a .php extension, the application passes it to the include() function, enabling local file inclusion on deployments using the PHP built-in server or specific non-default Nginx configurations.

Recommendations Update Cockpit CMS to version 364 or later.