This vulnerability affects the Spyc::YAMLLoad function in the /config/config.yaml file of the htaccess Handler component in agentejo Cockpit CMS up to version 0.12.2. Improper handling allows remote attackers to manipulate configuration leading to unauthorized access to files or directories. The issue is exploitable remotely without any privileges or user interaction. The vendor was notified but did not provide a fix or guidance. Public exploit details have been disclosed, but no known exploits in the wild are reported.

Successful exploitation allows remote attackers to access files or directories that should be restricted, potentially exposing sensitive information. The vulnerability does not require authentication or user interaction, increasing its risk. However, no evidence of active exploitation in the wild has been reported.

No official patch or fix is currently available from the vendor. Users should consider changing configuration settings to mitigate exposure as suggested by the disclosure. Monitor the vendor's channels for any future updates or patches. Until a fix is released, restrict access to the affected configuration files and limit exposure of the CMS to untrusted networks where possible.