CVE-2026-57856 describes a path traversal vulnerability in Cockpit CMS's Bucket file storage API endpoint (/system/buckets/api). The api() method sanitizes bucket names using a regex that removes characters except alphanumeric, dash, underscore, backslash, and dot, but this allows '..' and '../' sequences. When these sanitized bucket names are used in Flysystem paths, the WhitespacePathNormalizer resolves paths like 'buckets/..' to the root uploads directory without triggering path traversal detection. Consequently, an authenticated user with low privileges can craft requests with '../' in bucket names to access, list, upload, or delete files across all buckets, including those of other users or roles. No patch or official remediation is currently documented.

An authenticated user with low privileges can exploit this vulnerability to bypass intended access restrictions on bucket file storage. This leads to unauthorized access and modification capabilities across all buckets, potentially compromising data confidentiality and integrity for all users of the Cockpit CMS instance.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Bucket file storage API to trusted users only and monitor for suspicious activity involving bucket names containing path traversal sequences. Avoid exposing the vulnerable API endpoint to untrusted users.