CVE-2026-57856

Descrição

Cockpit CMS contains a path traversal vulnerability in the Bucket file storage API (/system/buckets/api). The api() method in modules/System/Controller/Buckets.php sanitizes the bucket name with preg_replace(-/[^a-zA-Z0-9-_\\.]/-,--, $bucket), which permits -..- and -../- sequences. The sanitized value is interpolated into a Flysystem path as uploads://buckets/{bucket}. Flysystem-s WhitespacePathNormalizer resolves -buckets/..- to the empty string (the uploads storage root) without raising PathTraversalDetected because the -..- has a preceding component to consume. An authenticated low-privileged user can send a crafted request with a -../- bucket name to list, upload, and delete files across all buckets, including those belonging to other users or roles