CVE-2026-58467 is a path traversal and local file inclusion vulnerability in cockpit-hq's Cockpit CMS through version 2.14.0 (affected versions <364). The vulnerability occurs because the application constructs filesystem paths using unvalidated PATH_INFO from REQUEST_URI without containment checks. Attackers can inject '../' sequences to traverse outside the designated spaces directory. If the resolved path ends with a .php extension, the application may include and execute that file, particularly on deployments using the PHP built-in server or specific non-default Nginx configurations. This allows unauthenticated attackers to read arbitrary files or execute PHP code locally.

An unauthenticated attacker can exploit this vulnerability to read arbitrary files on the server or execute PHP files, potentially leading to information disclosure or remote code execution depending on the server environment. The impact is high due to the ability to access sensitive files or execute code without authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid deploying Cockpit CMS in configurations that allow PHP file inclusion via PATH_INFO, such as the PHP built-in server or certain non-default Nginx setups. Implement strict input validation and containment checks on PATH_INFO to prevent directory traversal. Monitor vendor channels for patches or official mitigations.