{"id":"CVE-2026-91202","aliases":["ALSA-2026:84595","ALSA-2026:95570","DEBIAN-CVE-2026-91202","EUVD-2026-83298","GHSA-2g9g-mfvg-w359","RHSA-2026:84595","RLSA-2026:84595","RLSA-2026:95570","UBUNTU-CVE-2026-91202","openSUSE-SU-2026:11844-1"],"status":"published","title":"Cockpit-files: cockpit-files: arbitrary file ownership change via symlink following in privileged paste","description":"A flaw was found in cockpit-files. A low-privileged local user can exploit this vulnerability by crafting a directory containing a symbolic link (symlink) and then using the privileged \"Paste as owner\" function. This allows for arbitrary file ownership changes outside the intended pasted directory, leading to a compromise of data integrity. In some cases, this could also lead to reduced confidentiality if the new ownership grants unauthorized read access. Exploitation requires user interaction to select a non-original owner during the paste operation.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00156,"percentile":0.04815,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-61"],"published":"2026-09-18T19:21:11Z","modified":"2026-11-06T12:30:02Z","fixes":[{"ecosystem":"Debian:14","package":"cockpit-files","fixed_in":["45-1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"cockpit-files","fixed_in":["44-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"cockpit-files","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"36.1-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"cockpit-files","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"36.1-1.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Debian:14","package":"cockpit-files","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"45-1"}]}],"versions":["36-1","36-1~bpo13+1","38-1","39-1","40-1","41-1","43-1","43-1~bpo13+1","44-1","44-1~bpo13+1","45-1~bpo13+1"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"cockpit-files","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:36.1-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"cockpit-files","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:36.1-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:10","package":"cockpit-files","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:36.1-1.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"cockpit-files","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["39-1","40-1","41-1","43-1","44-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"cockpit-files","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["36-1","39-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cockpit-files","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"44-1.1"}]}]}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 9"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:84595","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:95570","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-91202","tags":["vdb-entry","x_refsource_REDHAT","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2465834","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91202","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-2g9g-mfvg-w359"},{"url":"https://access.redhat.com/security/cve/CVE-2026-91205","tags":["report"]},{"url":"https://bugzilla.redhat.com/2465834","tags":["report"]},{"url":"https://bugzilla.redhat.com/2466442","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-84595.html","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-91203","tags":["report"]},{"url":"https://bugzilla.redhat.com/2465632","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-95570.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-91202","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2466442","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_84595.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-91202","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-91205","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91205","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:84595","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:95570","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2465632","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-91202","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-91202","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-91202","title":"Cockpit-files: cockpit-files: arbitrary file ownership change via symlink following in privileged paste","description":"A flaw was found in cockpit-files. A low-privileged local user can exploit this vulnerability by crafting a directory containing a symbolic link (symlink) and then using the privileged \"Paste as owner\" function. This allows for arbitrary file ownership changes outside the intended pasted directory, leading to a compromise of data integrity. In some cases, this could also lead to reduced confidentiality if the new ownership grants unauthorized read access. Exploitation requires user interaction to select a non-original owner during the paste operation.","status":"published","published":"2026-09-18T19:21:11.039Z","modified":"2026-11-06T01:44:53.259Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-61"],"updated_at":"2026-11-06T02:55:55.947181Z"}],"euvd":[{"id":"EUVD-2026-83298","description":"A flaw was found in cockpit-files. A low-privileged local user can exploit this vulnerability by crafting a directory containing a symbolic link (symlink) and then using the privileged \"Paste as owner\" function. This allows for arbitrary file ownership changes outside the intended pasted directory, leading to a compromise of data integrity. In some cases, this could also lead to reduced confidentiality if the new ownership grants unauthorized read access. Exploitation requires user interaction to select a non-original owner during the paste operation.","status":"published","published":"2026-09-18T19:21:11Z","modified":"2026-11-06T01:44:53Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L","level":"medium"}],"updated_at":"2026-11-06T03:02:58.554056Z"}],"ghsa":[{"id":"GHSA-2g9g-mfvg-w359","title":"A flaw was found in cockpit-files. A low-privileged local user can exploit this vulnerability by...","description":"A flaw was found in cockpit-files. A low-privileged local user can exploit this vulnerability by crafting a directory containing a symbolic link (symlink) and then using the privileged \"Paste as owner\" function. This allows for arbitrary file ownership changes outside the intended pasted directory, leading to a compromise of data integrity. In some cases, this could also lead to reduced confidentiality if the new ownership grants unauthorized read access. Exploitation requires user interaction to select a non-original owner during the paste operation.","status":"published","published":"2026-09-18T21:32:27Z","modified":"2026-11-06T03:31:30Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L","level":"medium"}],"cwes":["CWE-61"],"updated_at":"2026-11-06T03:57:47.011451Z"}],"nvd":[{"id":"CVE-2026-91202","description":"A flaw was found in cockpit-files. A low-privileged local user can exploit this vulnerability by crafting a directory containing a symbolic link (symlink) and then using the privileged \"Paste as owner\" function. This allows for arbitrary file ownership changes outside the intended pasted directory, leading to a compromise of data integrity. In some cases, this could also lead to reduced confidentiality if the new ownership grants unauthorized read access. Exploitation requires user interaction to select a non-original owner during the paste operation.","status":"published","published":"2026-09-18T20:17:29.26Z","modified":"2026-11-06T02:17:57.32Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-61"],"updated_at":"2026-11-06T06:59:05.647867Z"}],"osv":[{"id":"DEBIAN-CVE-2026-91202","description":"A flaw was found in cockpit-files. A low-privileged local user can exploit this vulnerability by crafting a directory containing a symbolic link (symlink) and then using the privileged \"Paste as owner\" function. This allows for arbitrary file ownership changes outside the intended pasted directory, leading to a compromise of data integrity. In some cases, this could also lead to reduced confidentiality if the new ownership grants unauthorized read access. Exploitation requires user interaction to select a non-original owner during the paste operation.","status":"published","published":"2026-09-18T20:17:29.26Z","modified":"2026-10-23T17:47:31.155646707Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T15:46:06.410207Z"},{"id":"RHSA-2026:84595","title":"Red Hat Security Advisory: cockpit-files security update","status":"published","published":"2026-10-19T10:08:07Z","modified":"2026-10-20T10:17:41Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RLSA-2026:84595","title":"Moderate: cockpit-files security update","description":"A filesystem browser for Cockpit\n\nSecurity Fix(es):\n\n* cockpit-files: cockpit-files: Arbitrary file ownership change via symlink following in privileged paste (CVE-2026-91202)\n\n* cockpit-files: cockpit-files: Local attacker can hijack file ownership via symlink race (CVE-2026-91205)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-20T12:05:07.452289Z","modified":"2026-10-20T12:15:38.433880063Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"RLSA-2026:95570","title":"Moderate: cockpit-files security update","description":"A filesystem browser for Cockpit\n\nSecurity Fix(es):\n\n* cockpit-files: cockpit-files: Arbitrary file ownership and permission modification via symlink race condition (CVE-2026-91203)\n\n* cockpit-files: cockpit-files: Arbitrary file ownership change via symlink following in privileged paste (CVE-2026-91202)\n\n* cockpit-files: cockpit-files: Local attacker can hijack file ownership via symlink race (CVE-2026-91205)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-11-06T12:09:31.09095Z","modified":"2026-11-06T12:30:02.70556274Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L","level":"medium"}],"updated_at":"2026-11-06T12:43:06.926783Z"},{"id":"UBUNTU-CVE-2026-91202","description":"A flaw was found in cockpit-files. A low-privileged local user can exploit this vulnerability by crafting a directory containing a symbolic link (symlink) and then using the privileged \"Paste as owner\" function. This allows for arbitrary file ownership changes outside the intended pasted directory, leading to a compromise of data integrity. In some cases, this could also lead to reduced confidentiality if the new ownership grants unauthorized read access. Exploitation requires user interaction to select a non-original owner during the paste operation.","status":"published","published":"2026-09-18T20:17:00Z","modified":"2026-10-17T13:01:16.953710213Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T16:57:40.980117Z"},{"id":"ALSA-2026:84595","title":"Moderate: cockpit-files security update","description":"A filesystem browser for Cockpit  \n\nSecurity Fix(es):  \n\n  * cockpit-files: cockpit-files: Arbitrary file ownership change via symlink following in privileged paste (CVE-2026-91202)\n  * cockpit-files: cockpit-files: Local attacker can hijack file ownership via symlink race (CVE-2026-91205)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-19T00:00:00Z","modified":"2026-10-29T11:32:38.356950552Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:95570","title":"Moderate: cockpit-files security update","description":"A filesystem browser for Cockpit  \n\nSecurity Fix(es):  \n\n  * cockpit-files: cockpit-files: Arbitrary file ownership and permission modification via symlink race condition (CVE-2026-91203)\n  * cockpit-files: cockpit-files: Arbitrary file ownership change via symlink following in privileged paste (CVE-2026-91202)\n  * cockpit-files: cockpit-files: Local attacker can hijack file ownership via symlink race (CVE-2026-91205)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-11-05T00:00:00Z","modified":"2026-11-06T12:00:02.6612773Z","updated_at":"2026-11-06T12:12:56.168821Z"},{"id":"openSUSE-SU-2026:11844-1","title":"cockpit-files-44-1.1 on GA media","description":"These are all security issues fixed in the cockpit-files-44-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-22T00:00:00Z","modified":"2026-09-23T09:15:05.453877704Z","updated_at":"2026-11-02T16:58:39.516824Z"}]}}