Loading story…
Cockpit CMS disclosed two high-severity vulnerabilities affecting versions earlier than 2.14.0, including a missing authorization flaw in the Bucket file storage API tracked as CVE-2026-57855. The issue in /system/buckets/api stemmed from the api() method in modules/System/Controller/Buckets.php, which executed bucket commands without enforcing ACL or role checks. As a result, any authenticated user, including low-privilege editors or content managers, could list files, upload content, delete files, rename objects, and create folders in arbitrary buckets, including administrator-only storage areas.
The advisory also described a path traversal flaw in bucket name handling that allowed ../ sequences to escape intended bucket directories, further expanding the risk of unauthorized file access and manipulation. Cockpit CMS said both vulnerabilities were fixed in version 2.14.0, released after coordinated disclosure with VulnCheck, and the authorization bug was rated high severity with a CVSS 3.1 score of 8.8 and mapped to CWE-284.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Cockpit CMS publicly disclosed the broken access control and path traversal vulnerabilities after coordinated disclosure via VulnCheck. The disclosure stated that low-privilege authenticated users could access or manipulate files outside their authorized bucket scope.
The missing authorization vulnerability in Cockpit CMS's Bucket file storage API was published as CVE-2026-57855. The issue allows any authenticated user to perform bucket operations without ACL or role checks, including against admin-only buckets.
Cockpit CMS fixed the broken access control issue in the Buckets API in version 2.14.0. The advisory says versions earlier than 2.14.0 were affected and that the release also fixed a related path traversal issue.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcevulncheck.com
Open sourcegist.github.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity vulnerability tracked as **`CVE-2026-58467`** affects **Cockpit CMS** versions prior to release **364**, allowing unauthenticated attackers to exploit path traversal in `index.php` and access files outside the intended `spaces` directory. The flaw arises because `PATH_INFO`, derived from `REQUEST_URI`, is used to construct filesystem paths without proper containment checks, making arbitrary file reads possible through `..` traversal sequences. In affected deployments, the issue can escalate from file disclosure to local file inclusion if the resolved path ends in **`.php`** and is passed to `include()`. That can lead to PHP code execution in environments using the PHP built-in server or certain non-default Nginx configurations. The vulnerability has been rated **8.2 CVSS 4.0** and **7.5 CVSS 3.1**, and remediation is to upgrade to **Cockpit CMS release 364 or later** and harden filesystem path validation.
Jul 3, 2026
baserCMS disclosed and patched an OS command injection vulnerability in its update functionality that allowed an authenticated administrator to execute arbitrary operating system commands on the underlying server. The issue, tracked as **`CVE-2026-30877`** and **`CVE-2026-21861`**, affects baserCMS versions prior to **`5.2.3`** and stems from insufficient validation of user-controlled input passed to the update process, including unsafe handling around `exec()`. The vulnerability is classified as **`CWE-78`** and carries a **CVSS v3.1** vector of **`AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H`**, reflecting high impact to confidentiality, integrity, and availability despite requiring administrator privileges. baserCMS addressed the flaw in version **`5.2.3`**, with public references including the vendor security notice, the 5.2.3 release information, and a GitHub security advisory.
Jun 29, 2026
A high-severity vulnerability tracked as **CVE-2026-16337** affects **dotCMS** versions `21.02` through `26.06.22-03`, allowing a low-privileged authenticated backend user to escalate privileges and achieve remote code execution. The issue stems from improper authorization in the `ToolGroupResource` layout-assignment endpoints and `RoleAjax` REST/DWR methods, which let a user self-assign the administrative Settings layout, grant themselves the **CMS Administrator** role, and then upload a crafted OSGi bundle whose `BundleActivator` can run arbitrary shell commands on the host. dotCMS addressed the chain in core pull request **#36344** by enforcing **CMS Administrator** checks on `ToolGroupResource._addtouser`, `ToolGroupResource._removefromuser`, `RoleAjax.addUserToRole`, and `RoleAjax.removeUsersFromRole`, while preserving limited self-service behavior for the `gettingstarted` onboarding layout. A follow-up hardening change moved authorization checks ahead of `loadUserById` calls to block unauthorized requests before database access, and unit tests were added for the new admin gates and onboarding exceptions.
Jul 21, 2026