https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 18:08:24 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-57856 <p>Cockpit CMS contains a path traversal vulnerability in the Bucket file storage API (/system/buckets/api). The api() method in modules/System/Controller/Buckets.php sanitizes the bucket name with preg_replace(&#39;/[^a-zA-Z0-9-_\\.]/&#39;,&#39;&#39;, $bucket), which permits &#39;..&#39; and &#39;../&#39; sequences. The sanitized value is interpolated into a Flysystem path as uploads://buckets/{bucket}. Flysystem&#39;s WhitespacePathNormalizer resolves &#39;buckets/..&#39; to the empty string (the uploads storage root) without raising PathTraversalDetected because the &#39;..&#39; has a preceding component to consume. An authenticated low-privileged user can send a crafted request with a &#39;../&#39; bucket name to list, upload, and delete files across all buckets, including those belonging to other users or roles</p> <p>Cockpit CMS contains a path traversal vulnerability in the Bucket file storage API (/system/buckets/api). The api() method in modules/System/Controller/Buckets.php sanitizes the bucket name with preg_replace(&#39;/[^a-zA-Z0-9-_\\.]/&#39;,&#39;&#39;, $bucket), which permits &#39;..&#39; and &#39;../&#39; sequences. The sanitized value is interpolated into a Flysystem path as uploads://buckets/{bucket}. Flysystem&#39;s WhitespacePathNormalizer resolves &#39;buckets/..&#39; to the empty string (the uploads storage root) without raising PathTraversalDetected because the &#39;..&#39; has a preceding component to consume. An authenticated low-privileged user can send a crafted request with a &#39;../&#39; bucket name to list, upload, and delete files across all buckets, including those belonging to other users or roles</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-57856 https://vulnerability.circl.lu/vuln/ghsa-cfx5-q5qm-x936 <p>Cockpit CMS contains a path traversal vulnerability in the Bucket file storage API (/system/buckets/api). The api() method in modules/System/Controller/Buckets.php sanitizes the bucket name with preg_replace(&#39;/[^a-zA-Z0-9-_\\.]/&#39;,&#39;&#39;, $bucket), which permits &#39;..&#39; and &#39;../&#39; sequences. The sanitized value is interpolated into a Flysystem path as uploads://buckets/{bucket}. Flysystem&#39;s WhitespacePathNormalizer resolves &#39;buckets/..&#39; to the empty string (the uploads storage root) without raising PathTraversalDetected because the &#39;..&#39; has a preceding component to consume. An authenticated low-privileged user can send a crafted request with a &#39;../&#39; bucket name to list, upload, and delete files across all buckets, including those belonging to other users or roles</p> <p>Cockpit CMS contains a path traversal vulnerability in the Bucket file storage API (/system/buckets/api). The api() method in modules/System/Controller/Buckets.php sanitizes the bucket name with preg_replace(&#39;/[^a-zA-Z0-9-_\\.]/&#39;,&#39;&#39;, $bucket), which permits &#39;..&#39; and &#39;../&#39; sequences. The sanitized value is interpolated into a Flysystem path as uploads://buckets/{bucket}. Flysystem&#39;s WhitespacePathNormalizer resolves &#39;buckets/..&#39; to the empty string (the uploads storage root) without raising PathTraversalDetected because the &#39;..&#39; has a preceding component to consume. An authenticated low-privileged user can send a crafted request with a &#39;../&#39; bucket name to list, upload, and delete files across all buckets, including those belonging to other users or roles</p> https://vulnerability.circl.lu/vuln/ghsa-cfx5-q5qm-x936