CVE-2026-38993

Executive Summary

CVE-2026-38993 is a directory traversal vulnerability in the Buckets component of Cockpit CMS versions 2.13.5 and earlier. An authenticated attacker can exploit this flaw to write files to arbitrary locations within the uploads directory, or overwrite existing assets with malicious content. The vulnerability carries a CVSS score of 6.5 (Medium) and has been identified as CWE-22 (Path Traversal). While no public exploit code has been released, the attack surface is significant given Cockpit's widespread use as a headless CMS platform, and the EPSS score of 0.00836 places it in the 54.2nd percentile of exploited CVE candidates, suggesting active scanning interest.

Technical Analysis

The vulnerability resides in the Buckets component of Cockpit CMS, which handles file storage and retrieval for media assets. The Buckets API endpoint processes user-supplied file paths without adequately sanitizing directory traversal sequences (../ or absolute path variations). The flaw allows an authenticated attacker to manipulate the bucket file-path parameter to escape the intended uploads root directory.

The vulnerable code path is triggered when a user initiates a file write operation (e.g., PUT or POST to the bucket upload endpoint). The application constructs the destination file path by concatenating the user-controlled filename with the configured bucket storage path without validating that the resolved absolute path remains within the permitted directory. Specifically, filenames containing encoded traversal sequences (%2e%2e%2f or ..%2f) or raw ../ sequences are not normalized or checked against the expected base directory.

The attack surface is the authenticated web interface and any associated REST API endpoints that interact with the Buckets component. Because Cockpit CMS is often deployed as a headless backend serving multiple frontend applications, the authenticated attack vector can be reached by any user with at least editor-level privileges. The traversal distance is bounded by the filesystem layout but is sufficient to overwrite theme assets, configuration files, or other writable content accessible from the uploads directory.

The vulnerability is chainable: an attacker who successfully writes a malicious .php file (if PHP execution is enabled in the web root) or overwrites an existing JavaScript/CSS asset can achieve persistent code execution or defacement. In deployments where the uploads directory is served statically, the attacker can substitute malicious versions of existing assets that will be served to all site visitors.

Exploitation Scenarios

Scenario 1: Asset Overwrite for Persistent XSS

1. Reconnaissance: The attacker identifies a Cockpit CMS instance (version fingerprinting via GET / response headers or CHANGELOG.md). They authenticate with compromised or low-privileged editor credentials.
2. Trigger: The attacker enumerates known asset paths by requesting /uploads/images/logo.svg and observing the 200 response. They then craft the traversal payload: PUT /api/buckets/assets/files/../../assets/js/site.js with the malicious JavaScript body.
3. Weaponization: The malicious payload is a JavaScript file that exfiltrates session cookies or injects phishing overlays into the rendered site.
4. Execution: The server resolves the traversal path, overwriting the legitimate site.js file in the theme directory.
5. Post-Exploitation: All page loads execute the malicious script via the legitimate <script src="/assets/js/site.js"> tag, compromising every visitor to the site. The attacker gains full session hijacking capability against all users, including administrators.

Scenario 2: PHP Web Shell Deployment

1. Reconnaissance: The attacker fingerprints the deployment and confirms PHP files are executed in the web root (common in legacy Cockpit setups where uploads and app share the same vhost).
2. Trigger: The attacker crafts PUT /api/buckets/media/../../config/shell.php with a minimal PHP webshell payload (<?php system($_GET['cmd']); ?>).
3. Weaponization: The request is sent with valid session cookies and an Content-Type: application/octet-stream header to bypass file-type restrictions.
4. Execution: The path traversal resolves to the application config directory, planting shell.php.
5. Post-Exploitation: The attacker requests GET /config/shell.php?cmd=id and obtains uid=33(www-data). They escalate by reading database credentials from local configuration files and pivot to the underlying database server.

Scenario 3: Configuration File Corruption (Denial of Service)

1. Reconnaissance: The attacker with valid credentials maps the filesystem layout by testing traversal depth with timing-based detection.
2. Trigger: The attacker sends PUT /api/buckets/assets/../../../app/config/config.yaml containing a truncated/malformed YAML payload.
3. Weaponization: The payload is designed to break the parser rather than execute code.
4. Execution: The application overwrites its own configuration file.
5. Post-Exploitation: The CMS fails to boot on next restart, causing a full-site denial of service. The attacker monetizes by demanding ransom for the restoration credentials.

Impact Assessment

The CVSS 6.5 score (Medium severity) reflects the authenticated nature of the attack and the integrity-only impact. The vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N indicates no confidentiality loss but high integrity loss with no user interaction required. The attack complexity is low, and only low-level privileges (e.g., a content editor account) are necessary for successful exploitation.

Business impact is substantial in real-world deployments. Cockpit CMS is used for headless content management across enterprise marketing sites, documentation portals, and data-driven web applications. An attacker capable of overwriting web assets can:

• Deface public-facing sites — direct brand damage and customer trust erosion
• Plant malicious JavaScript — steal credentials from all site visitors, enabling broad account takeover campaigns
• Inject cryptocurrency miners or ad fraud scripts — financial losses and resource consumption
• Corrupt configuration files — extended service outages requiring manual recovery

The blast radius is bounded by the filesystem permissions of the web server user. In misconfigured deployments where the web process runs with elevated privileges or the uploads directory is symlinked to broader storage, traversal could reach unrelated applications on the same host. The lack of CISA KEV listing suggests no confirmed in-the-wild exploitation, but the EPSS percentile indicates above-median attacker interest, likely driven by automated scanning for known path traversal patterns.

Detection Guidance

Sigma Rule

title: Cockpit CMS Buckets Directory Traversal Attempt
id: 2f8c31a7-4c55-4d6e-9e21-9a3f9b8c4d12
status: experimental
description: Detects path traversal patterns in Cockpit CMS Buckets API requests
author: Valtersit Threat Intelligence
date: 2026/01/15
logsource:
  category: webserver
  product: apache
  definition: 'Apache access logs for Cockpit CMS deployments'
detection:
  selection:
    c-uri|contains:
      - '/api/buckets/'
      - '/buckets/'
    c-uri|contains|all:
      - '..'
      - '%2e%2e%2f'
      - '%2e%2e%5c'
      - '..%2f'
      - '..%5c'
  filter_known_good:
    c-uri|contains: '/api/buckets/assets/images/'
    c-uri|endswith: '.png'
  condition: selection and not filter_known_good
fields:
  - c-ip
  - c-uri
  - sc-status
  - cs-method
falsepositives:
  - Legitimate filenames containing '..' in the query string
  - URL decoders that normalize encoded traversal sequences
level: high

YARA Rule

rule Cockpit_Buckets_Traversal_Exploit
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects path traversal payloads targeting Cockpit CMS Buckets component"
        cve = "CVE-2026-38993"
        date = "2026-01-15"
        severity = "medium"
    strings:
        $api = "/api/buckets/" nocase
        $traversal1 = "..%2f" nocase
        $traversal2 = "..%5c" nocase
        $traversal3 = "%2e%2e%2f" nocase
        $traversal4 = "%2e%2e%5c" nocase
        $traversal5 = /\.\.\/\.\.\/\.\.\// nocase
        $traversal6 = /\.\.\\\.\.\\/ nocase
        $php_shell = "<?php" nocase
        $js_payload = "document.cookie" nocase
        $yaml_break = ":\n  -" nocase
    condition:
        $api and (
            any of ($traversal*) or
            ($php_shell and any of ($traversal*)) or
            ($js_payload and any of ($traversal*)) or
            ($yaml_break and any of ($traversal*))
        )
}

Suricata IDS Rule

alert http any any -> any any (
    msg:"CVE-2026-38993 Cockpit CMS Buckets Directory Traversal Attempt";
    flow:established,to_server;
    http.method;
    http.uri;
    content:"/api/buckets/";
    http_uri;
    content:"..";
    http_uri;
    content:"../";
    http_uri;
    distance:0;
    within:50;
    pcre:"/(?:%2e%2e%2f|\.\.\/|%2e%2e%5c|\.\.\\)/i";
    classtype:attempted-user;
    reference:cve,2026-38993;
    sid:10038993;
    rev:1;
    metadata:created_at 2026_01_15, updated_at 2026_01_15;
)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ network where event.category == "web" and http.request.method == "PUT" and
    wildcard(http.request.body.content, "*..%2f*") or
    wildcard(http.request.body.content, "*../*") or
    wildcard(http.request.body.content, "*..\\*") or
    wildcard(http.request.body.content, "*%2e%2e%2f*") ]
  [ file where event.action in ("write", "overwrite") and
    file.path : "*" and
    file.path != "*uploads*" ]

Splunk SPL Query

index=web sourcetype=access_combined
| where match(uri, "(?i)/api/buckets/")
  AND match(uri, "(?i)(\.\.\/|\.\.%5c|%2e%2e%2f|%2e%2e%5c)")
| eval method = case(
    method=="PUT", "write",
    method=="POST", "write",
    method=="GET", "read",
    true, "other")
| stats count by src_ip, uri, status, method, _time
| sort - count
| table _time, src_ip, method, uri, status, count
| rename src_ip AS "Source IP", uri AS "Request URI", status AS "HTTP Status"

Wazuh OSSEC Rule

<rule id="100389" level="10">
  <decoded>apache-accesslog</decoded>
  <match>/api/buckets/</match>
  <regex>(\/api\/buckets\/.*(\.\.\/|\.\.%5c|%2e%2e%2f|%2e%2e%5c).*)</regex>
  <description>Cockpit CMS (CVE-2026-38993) Buckets directory traversal attempt</description>
  <group>pci_dss_6.5.1,cve_2026_38993,cockpit_cms,path_traversal,</group>
  <mitre>
    <id>T1190</id>
  </mitre>
  <options>no_full_log</options>
  <frequency>5</frequency>
  <timeframe>60</timeframe>
  <same_source_ip />
</rule>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source (OSV) claims a patch exists, not independently confirmed).

Immediate Mitigations (recommended within 24 hours):

1. Restrict Buckets API access: Modify web server configuration to block PUT and POST methods on /api/buckets/* endpoints except for trusted IP ranges or via a reverse proxy with an allowlist of legitimate file-upload client IPs.
2. Enable input sanitization at the WAF: Deploy a Web Application Firewall rule that rejects any request to /api/buckets/ containing traversal sequences (../, ..%2f, %2e%2e%2f, URL-encoded variants) in the URI or request body.
3. Audit current filesystem integrity: Run find /path/to/cockpit/uploads -type f -newermt "YYYY-MM-DD" -exec md5sum {} \; and compare against known-good baselines to detect any prior asset modifications.

Patch/Upgrade Steps:

1. Monitor the OSV advisory feed for confirmation of the patched version (reported as 2.13.6).
2. Once confirmed, upgrade immediately:

# Assumes Composer-managed Cockpit CMS installation
composer require getcockpit/cockpit:^2.13.6 --update-with-dependencies

3. If the patch is not yet independently confirmed, contact the Cockpit CMS maintainers directly via the official GitHub issue tracker and verify the fix commit hash before deploying to production.

Long-Term Hardening:

1. Filesystem restrictions: Ensure the web server process runs under a low-privilege user (e.g., www-data) and that the uploads directory is a distinct mount point with no write access to adjacent application directories. Consider a read-only bind mount for the application root.
2. Input validation: Implement a reverse-proxy-level path normalization layer that rejects any filename containing traversal sequences before it reaches the application.
3. Continuous monitoring: Deploy the provided Sigma/Suricata/Elastic rules to your SIEM and IDS stack for ongoing detection of traversal attempts against Cockpit or any other CMS.
4. Least privilege: Review and restrict Buckets component access to only the user roles that genuinely require file upload capabilities. Remove editor-level write access where unnecessary.

References

1. NVD Entry — CVE-2026-38993: https://nvd.nist.gov/vuln/detail/CVE-2026-38993
2. OSV Advisory (patch claim source): https://osv.dev/vulnerability/CVE-2026-38993
3. CWE-22 — Path Traversal: https://cwe.mitre.org/data/definitions/22.html
4. Cockpit CMS Official Repository: https://github.com/Cockpit-HQ/Cockpit
5. MITRE ATT&CK Technique T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

Threat actor campaign notes: No publicly documented exploit-in-the-wild campaigns have been confirmed for this CVE as of the writing of this report. The CVE is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score of 0.00836 (54.2nd percentile) indicates moderate scanner interest, suggesting that automated vulnerability scanners are beginning to probe for this flaw, and exploitation attempts are likely imminent or already underway in noisy, opportunistic campaigns.