CVE-2026-91202Cockpit-files: cockpit-files: arbitrary file ownership change via symlink following in privileged paste
- 6.1MediumCVSS base score
- 0.16%Exploitation in 30 daysEPSS · top 95% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
A flaw was found in cockpit-files. A low-privileged local user can exploit this vulnerability by crafting a directory containing a symbolic link (symlink) and then using the privileged "Paste as owner" function. This allows for arbitrary file ownership changes outside the intended pasted directory, leading to a compromise of data integrity. In some cases, this could also lead to reduced confidentiality if the new ownership grants unauthorized read access. Exploitation requires user interaction to select a non-original owner during the paste operation.
Timeline
ID reserved
By redhat
- 4 days later
· 4 days later
Published
- 54 days later
· 54 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| redhatCNA (assigner) | 3.1 | Medium6.1 | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L |
| NVDNVD · Awaiting Analysis | 3.1 | Medium6.1 | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L |
- EPSS (exploitation in 30 days)
- 0.16% · top 95% of all CVEs (14 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.1.
Affected products
Red Hat · Red Hat Enterprise Linux 10
- unaffected 0:36.1-1.el10_2 – < *
Red Hat · Red Hat Enterprise Linux 10
- unaffected 0:43.1-1.el10_3 – < *
Red Hat · Red Hat Enterprise Linux 9
- unaffected 0:36.1-1.el9_8 – < *
Red Hat · Red Hat Enterprise Linux 9
- unaffected 0:43.1-1.el9_9 – < *
What to do
Workaround: A workaround is available for this issue: avoid using the privileged "Paste as owner" option in cockpit-files when pasting copied directory trees that may contain symlinks. If a privileged paste is required, keep the owner selection at "original", which skips the recursive chown code path entirely and prevents ownership changes from following symlinks to files outside the pasted directory. Once updated cockpit-files packages containing the fix are available for the affected streams, installing them resolves the issue.
References
References6
- RHSA-2026:84595 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- RHSA-2026:95570 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- RHSA-2026:98458 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- RHSA-2026:98566 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-91202 (opens in a new tab)vdb-entryx_refsource_REDHAT
- RHBZ#2465834 (opens in a new tab)issue-trackingx_refsource_REDHAT
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-83298 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-91202)Record last updated .