PT-2026-55289 · Unknown · Cockpit Cms

George Chen · Published 2026-07-02 · Updated 2026-07-03 · CVE-2026-58467

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cockpit CMS versions prior to 364

Description Unauthenticated attackers can read arbitrary files or execute PHP files due to a path traversal and local file inclusion issue. The application fails to perform containment checks when constructing filesystem paths using unvalidated PATH INFO derived from the REQUEST URI. By injecting dot-dot sequences into the URL, an attacker can traverse outside the designated spaces directory. If the resolved path ends with a .php extension, the application passes it to the include() function, enabling local file inclusion on deployments using the PHP built-in server or specific non-default Nginx configurations.

Recommendations Update Cockpit CMS to version 364 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-58467

Affected Products

Cockpit Cms

References · 7

• 🔥 https://github.com/geo-chen/oss/blob/main/cockpit.md · Exploit
• https://github.com/cockpit-project/cockpit/releases/tag/364 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-58467 · Security Note
• https://twitter.com/CVEnew/status/2072814575985283348 · Twitter Post
• https://twitter.com/infoflowcloud/status/2072815441559294096 · Twitter Post
• https://vulncheck.com/advisories/cockpit-cms-364-path-traversal-local-file-inclusion-via-index-php · Note
• https://twitter.com/disismohi/status/2073049920563449991 · Twitter Post