Medium · CVSS 6.1CVE-2026-91202

Cockpit-files: cockpit-files: arbitrary file ownership change via symlink following in privileged pasteCVE-2026-91202

Answer in brief

CVE-2026-91202 records a Medium severity (CVSS 6.1) vulnerability in Cockpit-files: cockpit-files: arbitrary file ownership change via symlink following in privileged paste. The current sources do not mark it as known exploited. The current feed maps Red Hat/cockpit-files (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Sep 18, 2026Updated Oct 19, 2026Source checked Nov 3, 2026First seen by HOL Sep 18, 2026Material review Oct 19, 2026

Upstream Advisory

Key facts

Risk: Medium · CVSS 6.1
Exploitation: Not marked as known exploited
Affected software: 1 mapped package or product
Fix availability: Not reported

Why this deserves its current priority

CVSS is 6.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps Red Hat/cockpit-files (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
Red Hat/cockpit-filesgeneric	*	Not reported

Recommended response

Check inventory. Check lockfiles and deployed manifests for Red Hat/cockpit-files.
Review the reported fix. Source-reported workaround: A workaround is available for this issue: avoid using the privileged "Paste as owner" option in cockpit-files when pasting copied directory trees that may contain symlinks. If a privileged paste is required, keep the owner selection at "original", which skips the recursive chown code path entirely and prevents ownership changes from following symlinks to files outside the pasted directory. Once updated cockpit-files packages containing the fix are available for the affected streams, installing them resolves the issue.

Evidence timeline and material changes

Published upstream
Sep 18, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Oct 19, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Sep 18, 2026

Sources and claim methodology

Upstream source description

A flaw was found in cockpit-files. A low-privileged local user can exploit this vulnerability by crafting a directory containing a symbolic link (symlink) and then using the privileged "Paste as owner" function. This allows for arbitrary file ownership changes outside the intended pasted directory, leading to a compromise of data integrity. In some cases, this could also lead to reduced confidentiality if the new ownership grants unauthorized read access. Exploitation requires user interaction to select a non-original owner during the paste operation.

Quoted source text, attributed separately from HOL analysis.

Package

Affected range

Fixed version

Red Hat/cockpit-filesgeneric

Not reported

Recommended response

Check inventory. Check lockfiles and deployed manifests for Red Hat/cockpit-files.

Review the reported fix. Source-reported workaround: A workaround is available for this issue: avoid using the privileged "Paste as owner" option in cockpit-files when pasting copied directory trees that may contain symlinks. If a privileged paste is required, keep the owner selection at "original", which skips the recursive chown code path entirely and prevents ownership changes from following symlinks to files outside the pasted directory. Once updated cockpit-files packages containing the fix are available for the affected streams, installing them resolves the issue.

Sources and claim methodology

Upstream source description

Quoted source text, attributed separately from HOL analysis.