https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 12:57:41 +0000 https://cve.radiocsirt.org/vuln/cve-2026-57856 <p><strong>Affected:</strong> Cockpit HQ Cockpit CMS</p> <p>Cockpit CMS contains a path traversal vulnerability in the Bucket file storage API (/system/buckets/api). The api() method in modules/System/Controller/Buckets.php sanitizes the bucket name with preg_replace(&#39;/[^a-zA-Z0-9-_\\.]/&#39;,&#39;&#39;, $bucket), which permits &#39;..&#39; and &#39;../&#39; sequences. The sanitized value is interpolated into a Flysystem path as uploads://buckets/{bucket}. Flysystem&#39;s WhitespacePathNormalizer resolves &#39;buckets/..&#39; to the empty string (the uploads storage root) without raising PathTraversalDetected because the &#39;..&#39; has a preceding component to consume. An authenticated low-privileged user can send a crafted request with a &#39;../&#39; bucket name to list, upload, and delete files across all buckets, including those belonging to other users or roles</p> <p><strong>Affected:</strong> Cockpit HQ Cockpit CMS</p> <p>Cockpit CMS contains a path traversal vulnerability in the Bucket file storage API (/system/buckets/api). The api() method in modules/System/Controller/Buckets.php sanitizes the bucket name with preg_replace(&#39;/[^a-zA-Z0-9-_\\.]/&#39;,&#39;&#39;, $bucket), which permits &#39;..&#39; and &#39;../&#39; sequences. The sanitized value is interpolated into a Flysystem path as uploads://buckets/{bucket}. Flysystem&#39;s WhitespacePathNormalizer resolves &#39;buckets/..&#39; to the empty string (the uploads storage root) without raising PathTraversalDetected because the &#39;..&#39; has a preceding component to consume. An authenticated low-privileged user can send a crafted request with a &#39;../&#39; bucket name to list, upload, and delete files across all buckets, including those belonging to other users or roles</p> https://cve.radiocsirt.org/vuln/cve-2026-57856