CVE-2026-58467 is a path traversal and local file inclusion vulnerability in cockpit-project's cockpit CMS versions prior to 364. The issue stems from the application including unvalidated PATH_INFO from REQUEST_URI in filesystem path construction without containment checks. Attackers can inject dot-dot sequences into the URL to traverse outside the designated spaces directory. If the resolved path ends with a .php extension, it is passed to PHP's include() function, enabling local file inclusion and potential code execution on deployments using the PHP built-in server or certain non-default Nginx configurations. This vulnerability requires no authentication and has a CVSS 4.0 score of 8.2, indicating high severity.

An unauthenticated attacker can read arbitrary files on the server or execute arbitrary PHP code by exploiting this vulnerability. This can lead to disclosure of sensitive information or remote code execution depending on the server configuration. The impact is significant on deployments using the PHP built-in server or specific Nginx configurations that allow PHP file inclusion via this vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using the PHP built-in server or non-default Nginx configurations that allow PHP file inclusion via PATH_INFO. Implement strict input validation and containment checks on PATH_INFO to prevent path traversal. Monitor vendor channels for an official patch or update to version 364 or later.