The vulnerability in Cockpit CMS (CVE-2026-57856) is a path traversal issue in the Bucket file storage API endpoint (/system/buckets/api). The api() method sanitizes bucket names using a regex that removes characters except letters, digits, hyphens, underscores, backslashes, and dots, but it does not prevent '..' or '../' sequences. These sequences are interpreted by Flysystem's WhitespacePathNormalizer to traverse directories, effectively allowing an attacker with low privileges to access and manipulate files outside their authorized buckets. This enables unauthorized file listing, uploading, and deletion across all buckets.

An authenticated user with low privileges can exploit this vulnerability to access, upload, and delete files in any bucket, including those belonging to other users or roles. This compromises data confidentiality, integrity, and availability within the Cockpit CMS file storage system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Bucket file storage API to trusted users only and monitor for suspicious activity related to bucket name parameters. Avoid using untrusted input in bucket names without proper validation that disallows directory traversal sequences.