RHSA-2026:84595MediumCVSS 6.1

Red Hat Security Advisory: cockpit-files security update

Published
October 19, 2026
Last Modified
October 19, 2026

🔗 CVE IDs covered (2)

CVE-2026-91202 →CVE-2026-91205 →

📋 Description

CVE-2026-91202 — cockpit-files: cockpit-files: Arbitrary file ownership change via symlink following in privileged paste CVE-2026-91205 — cockpit-files: cockpit-files: Local attacker can hijack file ownership via symlink race

🎯 Affected products3

  • Red Hat Enterprise Linux AppStream (v. 9)
  • cockpit-files-0:36.1-1.el9_8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • cockpit-files-0:36.1-1.el9_8.src as a component of Red Hat Enterprise Linux AppStream (v. 9)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: A workaround is available for this issue: avoid using the privileged "Paste as owner" option in cockpit-files when pasting copied directory trees that may contain symlinks. If a privileged paste is required, keep the owner selection at "original", which skips the recursive chown code path entirely and prevents ownership changes from following symlinks to files outside the pasted directory. Once updated cockpit-files packages containing the fix are available for the affected streams, installing them resolves the issue. Workaround: Avoid using the privileged owner-assignment directory-creation flow in Cockpit Files inside directories that are writable by untrusted local users. Restrict write permissions on shared parent directories, and where directories must remain shared and writable, apply the sticky bit so users cannot replace directory entries they do not own. Creating directories without an owner assignment does not trigger the vulnerable privileged chown path and can be used where the owner-setting feature is not required. Updated packages that address this flaw are being delivered for the actively maintained releases.

🔗 References (5)