Cockpit CMS up to version 2.14.0 constructs a file system path by appending the PATH_INFO portion of a request URL to a spaces directory without any validation. An attacker can embed sequences of '..' and forward slashes in the URL to escape the intended directory. When the resolved path ends with a .php extension, the application forwards it to include(), allowing local file inclusion. This vulnerability permits unauthenticated attackers to read arbitrary files or execute arbitrary PHP code on deployments that use the PHP built‑in server or certain non‑default Nginx configurations.

All installations of the Cockpit project’s CMS that run any release up to and including 2.14.0 are affected, because the vulnerable code is present in those releases. Vulnerable deployments include those exposed to public traffic and that employ the PHP built‑in server or Nginx configurations that forward PATH_INFO to the application.

The CVSS score of 8.2 marks the vulnerability as high severity, while the EPSS score of less than 1 % indicates a low likelihood of exploitation. The issue is not listed in the CISA KEV catalog. Attackers can trigger the flaw by crafting a URL that contains a malicious PATH_INFO segment, with authentication not required. Any publicly accessible instance is thus vulnerable, and exploitation can lead to confidential data disclosure or arbitrary code execution.