CVE-2026-91205
Cockpit-files: cockpit-files: local attacker can hijack file ownership via symlink race
A flaw was found in cockpit-files. A local unprivileged attacker can exploit a race condition during directory creation with owner assignment. By controlling a writable parent directory, the attacker can replace a newly created directory with a symbolic link (symlink) before the ownership change operation (chown) is applied. This allows the attacker to redirect the ownership change to an arbitrary file, potentially leading to information disclosure or unauthorized modification of sensitive files.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Cockpit-files: cockpit-files: local attacker can hijack file ownership via symlink race
A flaw was found in cockpit-files. A local unprivileged attacker can exploit a race condition during directory creation with owner assignment. By controlling a writable parent directory, the attacker can replace a newly created directory with a symbolic link (symlink) before the ownership change operation (chown) is applied. This allows the attacker to redirect the ownership change to an arbitrary file, potentially leading to information disclosure or unauthorized modification of sensitive files.
- Record
CVE-2026-91205- CVSS 3.1
- 6.0 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-363
- Updated
- 2026-11-06
EUVDEUVD-2026-83291
A flaw was found in cockpit-files. A local unprivileged attacker can exploit a race condition during directory creation with owner assignment. By controlling a writable parent directory, the attacker can replace a newly created directory with a symbolic link (symlink) before the ownership change operation (chown) is applied. This allows the attacker to redirect the ownership change to an arbitrary file, potentially leading to information disclosure or unauthorized modification of sensitive files.
- Record
EUVD-2026-83291- CVSS 3.1
- 6.0 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-06
GitHub AdvisoriesGHSA-5jj9-v4xp-h5h5
A flaw was found in cockpit-files. A local unprivileged attacker can exploit a race condition...
A flaw was found in cockpit-files. A local unprivileged attacker can exploit a race condition during directory creation with owner assignment. By controlling a writable parent directory, the attacker can replace a newly created directory with a symbolic link (symlink) before the ownership change operation (chown) is applied. This allows the attacker to redirect the ownership change to an arbitrary file, potentially leading to information disclosure or unauthorized modification of sensitive files.
- Record
GHSA-5jj9-v4xp-h5h5- CVSS 3.1
- 6.0 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-363
- Updated
- 2026-11-06
NVD
A flaw was found in cockpit-files. A local unprivileged attacker can exploit a race condition during directory creation with owner assignment. By controlling a writable parent directory, the attacker can replace a newly created directory with a symbolic link (symlink) before the ownership change operation (chown) is applied. This allows the attacker to redirect the ownership change to an arbitrary file, potentially leading to information disclosure or unauthorized modification of sensitive files.
- Record
CVE-2026-91205- CVSS 3.1
- 6.0 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-363
- Updated
- 2026-11-06
OSVDEBIAN-CVE-2026-91205
A flaw was found in cockpit-files. A local unprivileged attacker can exploit a race condition during directory creation with owner assignment. By controlling a writable parent directory, the attacker can replace a newly created directory with a symbolic link (symlink) before the ownership change operation (chown) is applied. This allows the attacker to redirect the ownership change to an arbitrary file, potentially leading to information disclosure or unauthorized modification of sensitive files.
- Record
DEBIAN-CVE-2026-91205- CVSS 3.1
- 6.0 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVRHSA-2026:84595
Red Hat Security Advisory: cockpit-files security update
- Record
RHSA-2026:84595- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L - Updated
- 2026-11-02
Show 5 moreShow less
OSVRLSA-2026:84595
Moderate: cockpit-files security update
A filesystem browser for Cockpit
Security Fix(es):
-
cockpit-files: cockpit-files: Arbitrary file ownership change via symlink following in privileged paste (CVE-2026-91202)
-
cockpit-files: cockpit-files: Local attacker can hijack file ownership via symlink race (CVE-2026-91205)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:84595- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L - Updated
- 2026-11-02
OSVRLSA-2026:95570
Moderate: cockpit-files security update
A filesystem browser for Cockpit
Security Fix(es):
-
cockpit-files: cockpit-files: Arbitrary file ownership and permission modification via symlink race condition (CVE-2026-91203)
-
cockpit-files: cockpit-files: Arbitrary file ownership change via symlink following in privileged paste (CVE-2026-91202)
-
cockpit-files: cockpit-files: Local attacker can hijack file ownership via symlink race (CVE-2026-91205)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:95570- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L - Updated
- 2026-11-06
OSVUBUNTU-CVE-2026-91205
A flaw was found in cockpit-files. A local unprivileged attacker can exploit a race condition during directory creation with owner assignment. By controlling a writable parent directory, the attacker can replace a newly created directory with a symbolic link (symlink) before the ownership change operation (chown) is applied. This allows the attacker to redirect the ownership change to an arbitrary file, potentially leading to information disclosure or unauthorized modification of sensitive files.
- Record
UBUNTU-CVE-2026-91205- CVSS 3.1
- 6.0 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVALSA-2026:84595 No score
Moderate: cockpit-files security update
A filesystem browser for Cockpit
Security Fix(es):
- cockpit-files: cockpit-files: Arbitrary file ownership change via symlink following in privileged paste (CVE-2026-91202)
- cockpit-files: cockpit-files: Local attacker can hijack file ownership via symlink race (CVE-2026-91205)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:84595- Updated
- 2026-11-02
OSVALSA-2026:95570 No score
Moderate: cockpit-files security update
A filesystem browser for Cockpit
Security Fix(es):
- cockpit-files: cockpit-files: Arbitrary file ownership and permission modification via symlink race condition (CVE-2026-91203)
- cockpit-files: cockpit-files: Arbitrary file ownership change via symlink following in privileged paste (CVE-2026-91202)
- cockpit-files: cockpit-files: Local attacker can hijack file ownership via symlink race (CVE-2026-91205)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:95570- Updated
- 2026-11-06
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cockpit-filesAlmaLinux:9 From an advisory covering 2 CVEs |
before 36.1-1.el9_8 | 36.1-1.el9_8 |
cockpit-filesAlmaLinux:10 From an advisory covering 3 CVEs |
before 36.1-1.el10_2 | 36.1-1.el10_2 |
cockpit-filesDebian:14 |
before 45-1, plus listed versions 36-136-1~bpo13+138-139-140-1 Show 6 moreShow less41-143-143-1~bpo13+144-144-1~bpo13+145-1~bpo13+1 |
45-1 |
cockpit-filesRed Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs |
before 0:36.1-1.el9_8 | 0:36.1-1.el9_8 |
cockpit-filesRocky Linux:9 From an advisory covering 2 CVEs |
before 0:36.1-1.el9_8 | 0:36.1-1.el9_8 |
cockpit-filesRocky Linux:10 From an advisory covering 3 CVEs |
before 0:36.1-1.el10_2 | 0:36.1-1.el10_2 |
cockpit-filesUbuntu:26.10 |
All versions, plus listed versions 39-140-141-143-144-1 |
None known |
cockpit-filesUbuntu:26.04:LTS |
All versions, plus listed versions 36-139-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| affected, aliases, references | OSV | |
| affected | CVE List, EUVD, GitHub Advisories, NVD | |
| facts, references | CVE List | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-91205 is a medium vulnerability (CVSS 6.0) in Red Hat Enterprise Linux 10, published September 18, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.11%, the 1st percentile. Fixed in cockpit-files 45-1.
References
access.redhat.com/errata/RHSA-2026:84595
bugzilla.redhat.com/show_bug.cgi?id=2466442
nvd.nist.gov/vuln/detail/CVE-2026-91205
github.com/advisories/GHSA-5jj9-v4xp-h5h5
Show 18 moreShow less
errata.almalinux.org/9/ALSA-2026-84595.html
security-tracker.debian.org/tracker/CVE-2026-91205
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_84595.json
cve.org/CVERecord?id=CVE-2026-91202
errata.rockylinux.org/RLSA-2026:84595
ubuntu.com/security/CVE-2026-91205