CVE-2026-58467: Cockpit-Hq Cockpit

High severity, CVSS 7.5. EPSS: 1.7% chance of exploitation in the next 30 days.

Cockpit CMS through 2.14.0 contains a path traversal and local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files or execute PHP files by including unvalidated PATH_INFO derived from REQUEST_URI in filesystem path construction without containment checks. Attackers can inject dot-dot sequences into the URL to traverse outside the designated spaces directory, and when the resolved path ends with a .php extension, the application passes it to include(), enabling local file inclusion on deployments using the PHP built-in server or certain non-default Nginx configurations.

Affected products

• Cockpit-Hq Cockpit: up to and including 2.14.0

Published 2026-07-02. Last modified 2026-07-14.