CVE-2026-13533

MEDIUM

agentejo Cockpit CMS htaccess config.yaml YAMLLoad file access

Title source: cna

Description

A security vulnerability has been detected in agentejo Cockpit CMS up to 0.12.2. Affected by this issue is the function Spyc::YAMLLoad of the file /config/config.yaml of the component htaccess Handler. Such manipulation leads to files or directories accessible. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. Configuration settings should be changed. The vendor was contacted early about this disclosure but did not respond in any way.

References (5)

Core 5

Core References

Third Party Advisory third-party-advisory

CVE-2026-13533 | CVE Analysis and Report

https://vuldb.com/cve/CVE-2026-13533

Vdb Entry, Technical Description vdb-entry technical-description

VDB-374541 | agentejo Cockpit CMS htaccess config.yaml YAMLLoad file access

https://vuldb.com/vuln/374541

Signature, Permissions Required signature permissions-required

VDB-374541 | CTI Indicators (IOB, IOC, TTP, IOA)

https://vuldb.com/vuln/374541/cti

Third Party Advisory third-party-advisory

Submit #841343 | Agentejo Cockpit CMS 0.12.2 CWE-552: Files or Directories Accessible to External Parties

https://vuldb.com/submit/841343

Exploit exploit

https://gist.github.com/nov-1337/3eb0a06c602ced9c3b11b675b53947da

Scores

CVSS v3 5.3

EPSS 0.0029

EPSS Percentile 20.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact partial

Details

CWE

CWE-425 CWE-552

Status published

Products (3)

agentejo/Cockpit CMS 0.12.0

agentejo/Cockpit CMS 0.12.1

agentejo/Cockpit CMS 0.12.2

Published Jun 29, 2026

Tracked Since Jun 29, 2026