Loading story…
A high-severity vulnerability tracked as CVE-2026-58467 affects Cockpit CMS versions prior to release 364, allowing unauthenticated attackers to exploit path traversal in index.php and access files outside the intended spaces directory. The flaw arises because PATH_INFO, derived from REQUEST_URI, is used to construct filesystem paths without proper containment checks, making arbitrary file reads possible through .. traversal sequences.
In affected deployments, the issue can escalate from file disclosure to local file inclusion if the resolved path ends in .php and is passed to include(). That can lead to PHP code execution in environments using the PHP built-in server or certain non-default Nginx configurations. The vulnerability has been rated 8.2 CVSS 4.0 and 7.5 CVSS 3.1, and remediation is to upgrade to Cockpit CMS release 364 or later and harden filesystem path validation.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
A high-severity path traversal and local file inclusion vulnerability affecting Cockpit CMS before release 364 was publicly disclosed. The issue allows unauthenticated attackers to traverse directories and access arbitrary files, and in some deployments may lead to PHP file execution via include().
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cockpit CMS disclosed two high-severity vulnerabilities affecting versions earlier than `2.14.0`, including a missing authorization flaw in the Bucket file storage API tracked as `CVE-2026-57855`. The issue in `/system/buckets/api` stemmed from the `api()` method in `modules/System/Controller/Buckets.php`, which executed bucket commands without enforcing ACL or role checks. As a result, any authenticated user, including low-privilege editors or content managers, could list files, upload content, delete files, rename objects, and create folders in arbitrary buckets, including administrator-only storage areas. The advisory also described a path traversal flaw in bucket name handling that allowed `../` sequences to escape intended bucket directories, further expanding the risk of unauthorized file access and manipulation. Cockpit CMS said both vulnerabilities were fixed in version `2.14.0`, released after coordinated disclosure with VulnCheck, and the authorization bug was rated high severity with a `CVSS 3.1` score of `8.8` and mapped to `CWE-284`.
Jul 14, 2026
**CVE-2024-56145** enables unauthenticated remote code execution in Craft CMS when PHP's `register_argc_argv` setting is enabled. Craft CMS bootstrap code accepted CLI-style options from the web-populated `$_SERVER['argv']` array, allowing query-string input to override application paths, including the templates directory. The affected condition was present in Craft CMS's official Docker configuration. An attacker can redirect template resolution to an attacker-controlled FTP server and leverage PHP's FTP stream wrapper to satisfy file-existence checks before Craft CMS downloads and renders a malicious Twig template. Although Twig blocked several direct dangerous callbacks, the published technique bypassed those restrictions through `call_user_func` used by the `sort` filter. Craft CMS fixed the flaw in versions **5.5.2** and **4.13.2** and later; organizations unable to upgrade should disable `register_argc_argv` and review exposed Craft deployments for suspicious template-path overrides.
Sep 3, 2026
Craft CMS disclosed and patched two **critical** vulnerabilities, `CVE-2025-32432` and `CVE-2024-58136`, that can be chained or abused to achieve **unauthenticated remote code execution** and full compromise of vulnerable servers. The flaws affect Craft CMS `5.x` before `5.6.17`, `4.x` before `4.14.15`, and `3.x` before `3.9.15`; one issue involves insufficient input validation in image transformation functionality, while the other stems from unsafe handling of the `__class` variable in the underlying Yii 2 framework. Researchers and national defenders reported that the vulnerabilities are being **actively exploited in the wild**, with investigations tying attacks to malicious requests targeting the `actions/assets/generate-transform` endpoint and abuse of `__class` parameters. Organizations running exposed Craft CMS instances were urged to patch immediately, review logs for suspicious POST activity, check file and system integrity, and rotate credentials if compromise is suspected.
Aug 15, 2026