Cockpit CMS builds filesystem paths by appending the PATH_INFO part of a request URI to the router’s spaces directory without validating the value. An attacker can inject sequences of dots and slashes into the URL to escape the intended directory, and when the resolved path ends with a ".php" extension the application forwards it to include(), enabling local file inclusion. This allows unauthenticated attackers to read arbitrary files or execute PHP code on deployments that use the PHP built‑in server or certain non‑default Nginx configurations.

All installations of the Cockpit project’s CMS that run a version prior to the 364 release are affected. The issue was fixed in release 364 by removing the insecure path construction, validating user input, and enforcing directory containment.

The CVSS score of 8.2 flags the vulnerability as high severity, but the EPSS score of less than 1 % indicates a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the flaw by crafting a URL that includes a malicious PATH_INFO segment; authentication is not required, so any publicly accessible instance is vulnerable.