Description (CNA)
Cockpit CMS through 2.14.0 contains a path traversal and local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files or execute PHP files by including unvalidated PATH_INFO derived from REQUEST_URI in filesystem path construction without containment checks. Attackers can inject dot-dot sequences into the URL to traverse outside the designated spaces directory, and when the resolved path ends with a .php extension, the application passes it to include(), enabling local file inclusion on deployments using the PHP built-in server or certain non-default Nginx configurations.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| cockpit-hq / cockpit | affected 0 through 2.14.0 |
CWE
CWE-22
References
- https://github.com/geo-chen/oss/blob/main/cockpit.md
- https://www.vulncheck.com/advisories/cockpit-cms-path-traversal-local-file-inclusion-via-index-php
ADP enrichment
No English description supplied.
No references supplied.