{"id":"CVE-2026-91205","aliases":["ALSA-2026:84595","ALSA-2026:95570","DEBIAN-CVE-2026-91205","EUVD-2026-83291","GHSA-5jj9-v4xp-h5h5","RHSA-2026:84595","RLSA-2026:84595","RLSA-2026:95570","UBUNTU-CVE-2026-91205"],"status":"published","title":"Cockpit-files: cockpit-files: local attacker can hijack file ownership via symlink race","description":"A flaw was found in cockpit-files. A local unprivileged attacker can exploit a race condition during directory creation with owner assignment. By controlling a writable parent directory, the attacker can replace a newly created directory with a symbolic link (symlink) before the ownership change operation (chown) is applied. This allows the attacker to redirect the ownership change to an arbitrary file, potentially leading to information disclosure or unauthorized modification of sensitive files.","severity":{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00112,"percentile":0.01366,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-363"],"published":"2026-09-18T19:14:47Z","modified":"2026-11-11T12:59:12Z","fixes":[{"ecosystem":"Debian:14","package":"cockpit-files","fixed_in":["45-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"cockpit-files","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"36.1-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"cockpit-files","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"36.1-1.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Debian:14","package":"cockpit-files","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"45-1"}]}],"versions":["36-1","36-1~bpo13+1","38-1","39-1","40-1","41-1","43-1","43-1~bpo13+1","44-1","44-1~bpo13+1","45-1~bpo13+1"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"cockpit-files","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:36.1-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"cockpit-files","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:36.1-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:10","package":"cockpit-files","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:36.1-1.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"cockpit-files","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["39-1","40-1","41-1","43-1","44-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"cockpit-files","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["36-1","39-1"]}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 9"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:84595","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:95570","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:98458","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:98566","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-91205","tags":["vdb-entry","x_refsource_REDHAT","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2466442","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91205","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-5jj9-v4xp-h5h5"},{"url":"https://access.redhat.com/security/cve/CVE-2026-91202","tags":["report"]},{"url":"https://bugzilla.redhat.com/2465834","tags":["report"]},{"url":"https://bugzilla.redhat.com/2466442","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-84595.html","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-91203","tags":["report"]},{"url":"https://bugzilla.redhat.com/2465632","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-95570.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-91205","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2465834","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_84595.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-91202","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91202","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-91205","tags":["advisory","report"]},{"url":"https://errata.rockylinux.org/RLSA-2026:84595","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:95570","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2465632","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-91205","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-91205","title":"Cockpit-files: cockpit-files: local attacker can hijack file ownership via symlink race","description":"A flaw was found in cockpit-files. A local unprivileged attacker can exploit a race condition during directory creation with owner assignment. By controlling a writable parent directory, the attacker can replace a newly created directory with a symbolic link (symlink) before the ownership change operation (chown) is applied. This allows the attacker to redirect the ownership change to an arbitrary file, potentially leading to information disclosure or unauthorized modification of sensitive files.","status":"published","published":"2026-09-18T19:14:47.221Z","modified":"2026-11-11T12:59:12.375Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-363"],"updated_at":"2026-11-11T13:28:05.136075Z"}],"euvd":[{"id":"EUVD-2026-83291","description":"A flaw was found in cockpit-files. A local unprivileged attacker can exploit a race condition during directory creation with owner assignment. By controlling a writable parent directory, the attacker can replace a newly created directory with a symbolic link (symlink) before the ownership change operation (chown) is applied. This allows the attacker to redirect the ownership change to an arbitrary file, potentially leading to information disclosure or unauthorized modification of sensitive files.","status":"published","published":"2026-09-18T19:14:47Z","modified":"2026-11-11T12:59:12Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-11T14:28:59.314266Z"}],"ghsa":[{"id":"GHSA-5jj9-v4xp-h5h5","title":"A flaw was found in cockpit-files. A local unprivileged attacker can exploit a race condition...","description":"A flaw was found in cockpit-files. A local unprivileged attacker can exploit a race condition during directory creation with owner assignment. By controlling a writable parent directory, the attacker can replace a newly created directory with a symbolic link (symlink) before the ownership change operation (chown) is applied. This allows the attacker to redirect the ownership change to an arbitrary file, potentially leading to information disclosure or unauthorized modification of sensitive files.","status":"published","published":"2026-09-18T21:32:27Z","modified":"2026-11-11T15:30:42Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"cwes":["CWE-363"],"updated_at":"2026-11-11T15:34:47.187237Z"}],"nvd":[{"id":"CVE-2026-91205","description":"A flaw was found in cockpit-files. A local unprivileged attacker can exploit a race condition during directory creation with owner assignment. By controlling a writable parent directory, the attacker can replace a newly created directory with a symbolic link (symlink) before the ownership change operation (chown) is applied. This allows the attacker to redirect the ownership change to an arbitrary file, potentially leading to information disclosure or unauthorized modification of sensitive files.","status":"published","published":"2026-09-18T20:17:29.533Z","modified":"2026-11-11T13:17:33.967Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-363"],"updated_at":"2026-11-11T15:25:15.031694Z"}],"osv":[{"id":"DEBIAN-CVE-2026-91205","description":"A flaw was found in cockpit-files. A local unprivileged attacker can exploit a race condition during directory creation with owner assignment. By controlling a writable parent directory, the attacker can replace a newly created directory with a symbolic link (symlink) before the ownership change operation (chown) is applied. This allows the attacker to redirect the ownership change to an arbitrary file, potentially leading to information disclosure or unauthorized modification of sensitive files.","status":"published","published":"2026-09-18T20:17:29.533Z","modified":"2026-10-23T17:47:26.10001708Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:46:06.410207Z"},{"id":"RHSA-2026:84595","title":"Red Hat Security Advisory: cockpit-files security update","status":"published","published":"2026-10-19T10:08:07Z","modified":"2026-10-20T10:17:41Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RLSA-2026:84595","title":"Moderate: cockpit-files security update","description":"A filesystem browser for Cockpit\n\nSecurity Fix(es):\n\n* cockpit-files: cockpit-files: Arbitrary file ownership change via symlink following in privileged paste (CVE-2026-91202)\n\n* cockpit-files: cockpit-files: Local attacker can hijack file ownership via symlink race (CVE-2026-91205)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-20T12:05:07.452289Z","modified":"2026-10-20T12:15:38.433880063Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"RLSA-2026:95570","title":"Moderate: cockpit-files security update","description":"A filesystem browser for Cockpit\n\nSecurity Fix(es):\n\n* cockpit-files: cockpit-files: Arbitrary file ownership and permission modification via symlink race condition (CVE-2026-91203)\n\n* cockpit-files: cockpit-files: Arbitrary file ownership change via symlink following in privileged paste (CVE-2026-91202)\n\n* cockpit-files: cockpit-files: Local attacker can hijack file ownership via symlink race (CVE-2026-91205)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-11-06T12:09:31.09095Z","modified":"2026-11-06T12:30:02.70556274Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L","level":"medium"}],"updated_at":"2026-11-06T12:43:06.926783Z"},{"id":"UBUNTU-CVE-2026-91205","description":"A flaw was found in cockpit-files. A local unprivileged attacker can exploit a race condition during directory creation with owner assignment. By controlling a writable parent directory, the attacker can replace a newly created directory with a symbolic link (symlink) before the ownership change operation (chown) is applied. This allows the attacker to redirect the ownership change to an arbitrary file, potentially leading to information disclosure or unauthorized modification of sensitive files.","status":"published","published":"2026-09-18T20:17:00Z","modified":"2026-10-17T13:01:16.835905487Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T16:57:40.980117Z"},{"id":"ALSA-2026:84595","title":"Moderate: cockpit-files security update","description":"A filesystem browser for Cockpit  \n\nSecurity Fix(es):  \n\n  * cockpit-files: cockpit-files: Arbitrary file ownership change via symlink following in privileged paste (CVE-2026-91202)\n  * cockpit-files: cockpit-files: Local attacker can hijack file ownership via symlink race (CVE-2026-91205)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-19T00:00:00Z","modified":"2026-10-29T11:32:38.356950552Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:95570","title":"Moderate: cockpit-files security update","description":"A filesystem browser for Cockpit  \n\nSecurity Fix(es):  \n\n  * cockpit-files: cockpit-files: Arbitrary file ownership and permission modification via symlink race condition (CVE-2026-91203)\n  * cockpit-files: cockpit-files: Arbitrary file ownership change via symlink following in privileged paste (CVE-2026-91202)\n  * cockpit-files: cockpit-files: Local attacker can hijack file ownership via symlink race (CVE-2026-91205)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-11-05T00:00:00Z","modified":"2026-11-06T12:00:02.6612773Z","updated_at":"2026-11-06T12:12:56.168821Z"}]}}