CVE-2026-57856

Cockpit CMS contains a path traversal vulnerability in the Bucket file storage API (/system/buckets/api). The api() method in modules/System/Controller/Buckets.php sanitizes the bucket name with preg_replace('/[^a-zA-Z0-9-_\\.]/','', $bucket), which permits '..' and '../' sequences. The sanitized value is interpolated into a Flysystem path as uploads://buckets/{bucket}. Flysystem's WhitespacePathNormalizer resolves 'buckets/..' to the empty string (the uploads storage root) without raising PathTraversalDetected because the '..' has a preceding component to consume. An authenticated low-privileged user can send a crafted request with a '../' bucket name to list, upload, and delete files across all buckets, including those belonging to other users or roles

• CWE-22

• https://gist.github.com/sermikr0/821c4edd3c34e98a62a50b07707785bd
• https://github.com/Cockpit-HQ/Cockpit/commit/dde2d1d74f5f4e11de42a298918ea8c9684f932c
• https://github.com/cockpit-hq/cockpit
• https://www.vulncheck.com/advisories/cockpit-cms-missing-authorization-in-bucket-file-storage-api
• https://www.vulncheck.com/advisories/cockpit-cms-path-traversal-via-bucket-name-in-bucket-file-storage-api
• https://gist.github.com/sermikr0/821c4edd3c34e98a62a50b07707785bd

Published

Jul 13, 2026

Last Modified

Jul 14, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-57848Stoat for Android exports the chat.stoat.activities.ShareTar…6.8
• CVE-2026-5785Zohocorp ManageEngine PAM360 versions before 8531 and Manage…8.1
• CVE-2026-57850RustDesk before 1.4.9 does not enforce a session's authorize…8.7
• CVE-2026-57851MSI Feature Manager contains a local privilege escalation vu…8.5
• CVE-2026-57852Grav CMS scheduler-webhook plugin contains an authentication…6.3
• CVE-2026-57855Cockpit CMS contains a missing authorization vulnerability i…8.8
• CVE-2026-57857The Flow Payment plugin for WordPress (flow.cl) version 3.0.…5.1
• CVE-2026-57858Cal.com Cal.diy versions 2.1.1 through 6.2.0 contain a store…8.9
• CVE-2026-57859e107 prior to version 2.3.8 contains a code execution vulner…7.7
• CVE-2026-5786An Improper Access Control vulnerability in Ivanti EPMM befo…8.8
• CVE-2026-57860ForgeCode (tailcallhq/forgecode), an AI pair-programming CLI…7.8
• CVE-2026-57862Kanboard 1.2.52 and prior contains a server-side request for…8.5