CVE-2026-13533
agentejo Cockpit CMS htaccess config.yaml YAMLLoad file access
- State
- Published
- Severity
- 6.9 Medium
- Published
- Jun 29, 2026
- Updated
- Jun 29, 2026
- Reserved
- Jun 28, 2026
Description
A security vulnerability has been detected in agentejo Cockpit CMS up to 0.12.2. Affected by this issue is the function Spyc::YAMLLoad of the file /config/config.yaml of the component htaccess Handler. Such manipulation leads to files or directories accessible. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. Configuration settings should be changed. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:W/RC:R | VulDB |
| 3.0 | 5.3 Medium | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:W/RC:R | VulDB |
| 2.0 | 5.0 Medium | AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:W/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
Cockpit CMSagentejo |
|
References
- VDB-374541 | agentejo Cockpit CMS htaccess config.yaml YAMLLoad file accessvdb-entrytechnical-description
- VDB-374541 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- CVE-2026-13533 | CVE Analysis and Reportthird-party-advisory
- Submit #841343 | Agentejo Cockpit CMS 0.12.2 CWE-552: Files or Directories Accessible to External Partiesthird-party-advisory
- https://gist.github.com/nov-1337/3eb0a06c602ced9c3b11b675b53947daexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.