CVE-2026-91202
Cockpit-files: cockpit-files: arbitrary file ownership change via symlink following in privileged paste
A flaw was found in cockpit-files. A low-privileged local user can exploit this vulnerability by crafting a directory containing a symbolic link (symlink) and then using the privileged "Paste as owner" function. This allows for arbitrary file ownership changes outside the intended pasted directory, leading to a compromise of data integrity. In some cases, this could also lead to reduced confidentiality if the new ownership grants unauthorized read access. Exploitation requires user interaction to select a non-original owner during the paste operation.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- High
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Cockpit-files: cockpit-files: arbitrary file ownership change via symlink following in privileged paste
A flaw was found in cockpit-files. A low-privileged local user can exploit this vulnerability by crafting a directory containing a symbolic link (symlink) and then using the privileged "Paste as owner" function. This allows for arbitrary file ownership changes outside the intended pasted directory, leading to a compromise of data integrity. In some cases, this could also lead to reduced confidentiality if the new ownership grants unauthorized read access. Exploitation requires user interaction to select a non-original owner during the paste operation.
- Record
CVE-2026-91202- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L - Weakness
- CWE-61
- Updated
- 2026-11-06
EUVDEUVD-2026-83298
A flaw was found in cockpit-files. A low-privileged local user can exploit this vulnerability by crafting a directory containing a symbolic link (symlink) and then using the privileged "Paste as owner" function. This allows for arbitrary file ownership changes outside the intended pasted directory, leading to a compromise of data integrity. In some cases, this could also lead to reduced confidentiality if the new ownership grants unauthorized read access. Exploitation requires user interaction to select a non-original owner during the paste operation.
- Record
EUVD-2026-83298- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L - Updated
- 2026-11-06
GitHub AdvisoriesGHSA-2g9g-mfvg-w359
A flaw was found in cockpit-files. A low-privileged local user can exploit this vulnerability by...
A flaw was found in cockpit-files. A low-privileged local user can exploit this vulnerability by crafting a directory containing a symbolic link (symlink) and then using the privileged "Paste as owner" function. This allows for arbitrary file ownership changes outside the intended pasted directory, leading to a compromise of data integrity. In some cases, this could also lead to reduced confidentiality if the new ownership grants unauthorized read access. Exploitation requires user interaction to select a non-original owner during the paste operation.
- Record
GHSA-2g9g-mfvg-w359- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L - Weakness
- CWE-61
- Updated
- 2026-11-06
NVD
A flaw was found in cockpit-files. A low-privileged local user can exploit this vulnerability by crafting a directory containing a symbolic link (symlink) and then using the privileged "Paste as owner" function. This allows for arbitrary file ownership changes outside the intended pasted directory, leading to a compromise of data integrity. In some cases, this could also lead to reduced confidentiality if the new ownership grants unauthorized read access. Exploitation requires user interaction to select a non-original owner during the paste operation.
- Record
CVE-2026-91202- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L - Weakness
- CWE-61
- Updated
- 2026-11-06
OSVDEBIAN-CVE-2026-91202
A flaw was found in cockpit-files. A low-privileged local user can exploit this vulnerability by crafting a directory containing a symbolic link (symlink) and then using the privileged "Paste as owner" function. This allows for arbitrary file ownership changes outside the intended pasted directory, leading to a compromise of data integrity. In some cases, this could also lead to reduced confidentiality if the new ownership grants unauthorized read access. Exploitation requires user interaction to select a non-original owner during the paste operation.
- Record
DEBIAN-CVE-2026-91202- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L - Updated
- 2026-11-02
OSVRHSA-2026:84595
Red Hat Security Advisory: cockpit-files security update
- Record
RHSA-2026:84595- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L - Updated
- 2026-11-02
Show 6 moreShow less
OSVRLSA-2026:84595
Moderate: cockpit-files security update
A filesystem browser for Cockpit
Security Fix(es):
-
cockpit-files: cockpit-files: Arbitrary file ownership change via symlink following in privileged paste (CVE-2026-91202)
-
cockpit-files: cockpit-files: Local attacker can hijack file ownership via symlink race (CVE-2026-91205)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:84595- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L - Updated
- 2026-11-02
OSVRLSA-2026:95570
Moderate: cockpit-files security update
A filesystem browser for Cockpit
Security Fix(es):
-
cockpit-files: cockpit-files: Arbitrary file ownership and permission modification via symlink race condition (CVE-2026-91203)
-
cockpit-files: cockpit-files: Arbitrary file ownership change via symlink following in privileged paste (CVE-2026-91202)
-
cockpit-files: cockpit-files: Local attacker can hijack file ownership via symlink race (CVE-2026-91205)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:95570- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L - Updated
- 2026-11-06
OSVUBUNTU-CVE-2026-91202
A flaw was found in cockpit-files. A low-privileged local user can exploit this vulnerability by crafting a directory containing a symbolic link (symlink) and then using the privileged "Paste as owner" function. This allows for arbitrary file ownership changes outside the intended pasted directory, leading to a compromise of data integrity. In some cases, this could also lead to reduced confidentiality if the new ownership grants unauthorized read access. Exploitation requires user interaction to select a non-original owner during the paste operation.
- Record
UBUNTU-CVE-2026-91202- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L - Updated
- 2026-11-02
OSVALSA-2026:84595 No score
Moderate: cockpit-files security update
A filesystem browser for Cockpit
Security Fix(es):
- cockpit-files: cockpit-files: Arbitrary file ownership change via symlink following in privileged paste (CVE-2026-91202)
- cockpit-files: cockpit-files: Local attacker can hijack file ownership via symlink race (CVE-2026-91205)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:84595- Updated
- 2026-11-02
OSVALSA-2026:95570 No score
Moderate: cockpit-files security update
A filesystem browser for Cockpit
Security Fix(es):
- cockpit-files: cockpit-files: Arbitrary file ownership and permission modification via symlink race condition (CVE-2026-91203)
- cockpit-files: cockpit-files: Arbitrary file ownership change via symlink following in privileged paste (CVE-2026-91202)
- cockpit-files: cockpit-files: Local attacker can hijack file ownership via symlink race (CVE-2026-91205)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:95570- Updated
- 2026-11-06
OSVopenSUSE-SU-2026:11844-1 No score
cockpit-files-44-1.1 on GA media
These are all security issues fixed in the cockpit-files-44-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11844-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cockpit-filesAlmaLinux:9 From an advisory covering 2 CVEs |
before 36.1-1.el9_8 | 36.1-1.el9_8 |
cockpit-filesAlmaLinux:10 From an advisory covering 3 CVEs |
before 36.1-1.el10_2 | 36.1-1.el10_2 |
cockpit-filesDebian:14 |
before 45-1, plus listed versions 36-136-1~bpo13+138-139-140-1 Show 6 moreShow less41-143-143-1~bpo13+144-144-1~bpo13+145-1~bpo13+1 |
45-1 |
cockpit-filesRed Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs |
before 0:36.1-1.el9_8 | 0:36.1-1.el9_8 |
cockpit-filesRocky Linux:9 From an advisory covering 2 CVEs |
before 0:36.1-1.el9_8 | 0:36.1-1.el9_8 |
cockpit-filesRocky Linux:10 From an advisory covering 3 CVEs |
before 0:36.1-1.el10_2 | 0:36.1-1.el10_2 |
cockpit-filesUbuntu:26.10 |
All versions, plus listed versions 39-140-141-143-144-1 |
None known |
cockpit-filesUbuntu:26.04:LTS |
All versions, plus listed versions 36-139-1 |
None known |
cockpit-filesopenSUSE:Tumbleweed |
before 44-1.1 | 44-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| affected, aliases, references | OSV | |
| affected | EUVD, GitHub Advisories, NVD | |
| facts, references | CVE List | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-91202 is a medium vulnerability (CVSS 6.1) in Red Hat Enterprise Linux 10, published September 18, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.16%, the 4th percentile. Fixed in cockpit-files 45-1.
References
access.redhat.com/errata/RHSA-2026:84595
bugzilla.redhat.com/show_bug.cgi?id=2465834
nvd.nist.gov/vuln/detail/CVE-2026-91202
github.com/advisories/GHSA-2g9g-mfvg-w359
Show 19 moreShow less
errata.almalinux.org/9/ALSA-2026-84595.html
security-tracker.debian.org/tracker/CVE-2026-91202
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_84595.json
cve.org/CVERecord?id=CVE-2026-91202
errata.rockylinux.org/RLSA-2026:84595
ubuntu.com/security/CVE-2026-91202
suse.com/security/cve/CVE-2026-91202