cockpit-cms-security-advisory-2026.md

Security Advisory: Cockpit CMS — Broken Access Control + Path Traversal in Buckets API

Product: Cockpit CMS (Cockpit-HQ/Cockpit)
Affected versions: < v2.14.0
Fixed in: v2.14.0 (released 2026-03-30)
Reporter: Saidakbarxon Maxsudxonov
Disclosure: Coordinated via VulnCheck (submission ID: fba7701c-ef28-4464-9c4c-0f1291903688)
Date: 2026-07-14

---

Vulnerability 1: Broken Access Control in Buckets API (CWE-284)

CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H — 8.8 HIGH
File: modules/System/Controller/Buckets.php — public function api()

Description

Any authenticated user (editor, content manager role) could perform all bucket operations — upload, ls, removefiles, rename, createfolder — on any bucket in the system, regardless of per-bucket ACL or role assignment.

The api() method checked only that the user was authenticated, but performed no ownership check or per-bucket permission enforcement before executing bucket actions.

Impact

An editor-level account could read, overwrite, rename, or delete files from admin-only or private buckets, leading to full data integrity and confidentiality compromise of the file storage layer.

Patch

Commit message: "Content: Validate and enforce ACL permissions on $lookup stages in aggregate pipeline"
Reference: https://github.com/Cockpit-HQ/Cockpit/blob/master/CHANGELOG.md

---

Vulnerability 2: Path Traversal via Bucket Name (CWE-22)

CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H — 8.8 HIGH
File: modules/System/Controller/Buckets.php

Description

The bucket name parameter accepted ../ path traversal sequences. The input sanitizer permitted . characters, and Flysystem resolved buckets/.. to the filesystem root path without throwing an exception, silently allowing traversal outside the intended bucket directory.

Proof of Concept

GET /api/system/buckets/../admin-bucket/ls HTTP/1.1
Host: target.example.com
Authorization: Bearer <editor_token>

HTTP/1.1 200 OK
{"entries": [...admin bucket contents...]}

An editor-role user could:

1. List files from any bucket via ../bucket-name/ls
2. Download files from restricted buckets
3. Delete admin-only files via ../admin-bucket/removefiles

Patch

Commit message: "Fix Bucket path traversal vulnerability"
Reference: https://github.com/Cockpit-HQ/Cockpit/blob/master/CHANGELOG.md

---

Timeline

Date	Event
2026-06-04	Vulnerabilities reported to VulnCheck for coordinated disclosure
2026-06-04	VulnCheck began vendor (Cockpit-HQ) outreach
2026-03-30	Cockpit CMS v2.14.0 released, both issues patched
2026-07-14	Public disclosure

---

References

• Cockpit CMS CHANGELOG: https://github.com/Cockpit-HQ/Cockpit/blob/master/CHANGELOG.md
• Cockpit CMS Repository: https://github.com/Cockpit-HQ/Cockpit