CVE-2026-57856 – Cockpit CMS Path Traversal via Bucket Name in Bucket File Storage API

CVE ID :CVE-2026-57856

Published : July 13, 2026, 11:16 p.m. | 13 minutes ago

Description :Cockpit CMS contains a path traversal vulnerability in the Bucket file storage API (/system/buckets/api). The api() method in modules/System/Controller/Buckets.php sanitizes the bucket name with preg_replace(‘/[^a-zA-Z0-9-_\.]/’,”, $bucket), which permits ‘..’ and ‘../’ sequences. The sanitized value is interpolated into a Flysystem path as uploads://buckets/{bucket}. Flysystem’s WhitespacePathNormalizer resolves ‘buckets/..’ to the empty string (the uploads storage root) without raising PathTraversalDetected because the ‘..’ has a preceding component to consume. An authenticated low-privileged user can send a crafted request with a ‘../’ bucket name to list, upload, and delete files across all buckets, including those belonging to other users or roles

Severity: 8.8 | HIGH

Visit the link for more details, such as CVSS details, affected products, timeline, and more…