The vulnerability lies in the Spyc::YAMLLoad function used by the htaccess Handler of Cockpit CMS’s config.yaml. By manipulating the loader’s input, an attacker can read or list arbitrary files or directories on the server, leading to confidential data disclosure or a foothold for further compromise. The weakness stems from improper handling of YAML configuration, corresponding to CWE‑425 – mutation of data via remote control, and CWE‑552 – reading of arbitrary files.

All installations of agentejo Cockpit CMS up to and including version 0.12.2 are affected. No other vendors or products are listed in the CVE report. The component involved is the htaccess Handler that processes /config/config.yaml.

The CVSS score of 6.9 indicates medium severity, while EPSS data is unavailable and the vulnerability is not listed in CISA’s KEV catalog, suggesting that widespread exploitation has not been observed. The attack can be carried out remotely by sending crafted data to the exposed htaccess endpoint. Because the affected component is reachable over the network and no known patch is publicly documented, administrators should consider the risk to be medium with a realistic possibility of exploitation if the component is externally accessible.