An authenticated low‑privileged user can send a crafted request to the /system/buckets/api endpoint with a bucket name containing '..' or '../'. The api() method in modules/System/Controller/Buckets.php sanitizes the bucket value only by stripping non‑alphanumeric characters, so the traversal sequences survive. These are then interpolated into{bucket}. Flysystem’s WhitespacePathNormalizer interprets 'buckets/..' as the root uploads folder, effectively allowing the attacker to list, upload, or delete files in any bucket, including those belonging to other users or roles. This capability to read or modify arbitrary files compromises confidentiality, integrity, and potentially availability of user data.

The affected product is Cockpit HQ’s Cockpit CMS. Versions containing the vulnerable code include any releases that have not yet incorporated the commit dde2d1d74f5f4e11de42a298918ea8c9684f932c, which applies a stricter validation on the bucket name. No specific major or minor version numbers are listed, so all current releases prior to this fix are considered at risk.

The CVSS score of 8.7 indicates a high‑severity flaw. An EPSS score of <1% indicates a very low likelihood of exploitation in the wild. The lack of a KEV listing suggests no confirmed public exploits yet. Nonetheless, the attack requires only an authenticated low‑privileged account and a crafted REST call, who can elevate privileges through other compromise data across buckets. Because the vulnerability grants read/write/delete capabilities, the impact spans confidentiality, integrity, and availability for affected users.