MiracleLinux 9 : cockpit-files-36.1-1.el9_8 (AXSA:2026-2124:03)

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-2124:03 advisory. cockpit-files: cockpit-files: Arbitrary file ownership change via symlink following in privileged paste CVE-2026-91202 cockpit-files: cockpit-files:...

AlmaLinux 9 : cockpit-files (ALSA-2026:84595)

The remote AlmaLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:84595 advisory. cockpit-files: cockpit-files: Arbitrary file ownership change via symlink following in privileged paste CVE-2026-91202 cockpit-files: cockpit-files: Loca...

Oracle Linux 9 : cockpit-files (ELSA-2026-84595)

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-84595 advisory. - CVE-2026-91202 - Don't de-reference a symlink when creating a directory RHEL-263134 Tenable has extracted the preceding description block directly...

Rocky Linux 9 [CIQ] Security Update: cockpit-files Multiple Vulnerabilities (crlsa-2026_84595)

The Rocky Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ crlsa-202684595 advisory. cockpit-files: cockpit-files: Arbitrary file ownership change via symlink following in privileged paste CVE-2026-91202 cockpit-files: cockpit-files: Local...

RLSA-2026:84595 Moderate: cockpit-files security update

A filesystem browser for Cockpit Security Fixes: cockpit-files: cockpit-files: Arbitrary file ownership change via symlink following in privileged paste CVE-2026-91202 cockpit-files: cockpit-files: Local attacker can hijack file ownership via symlink race CVE-2026-91205 For more details about the...

cockpit-files security update

An update is available for cockpit-files. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list A filesystem browser for Cockpit Security Fixes: cockpit-files:...

RockyLinux 9 : cockpit-files (RLSA-2026:84595)

The remote RockyLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RLSA-2026:84595 advisory. cockpit-files: cockpit-files: Arbitrary file ownership change via symlink following in privileged paste CVE-2026-91202 cockpit-files: cockpit-files: Loc...

Moderate: Red Hat Security Advisory: cockpit-files security update

An update for cockpit-files is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

cockpit-files: cockpit-files: Arbitrary file ownership change via symlink following in privileged paste

A flaw was found in cockpit-files. A low-privileged local user can exploit this vulnerability by crafting a directory containing a symbolic link symlink and then using the privileged "Paste as owner" function. This allows for arbitrary file ownership changes outside the intended pasted directory,...

cockpit-files: cockpit-files: Local attacker can hijack file ownership via symlink race

A flaw was found in cockpit-files. A local unprivileged attacker can exploit a race condition during directory creation with owner assignment. By controlling a writable parent directory, the attacker can replace a newly created directory with a symbolic link symlink before the ownership change...

cockpit-files security update

36.1-1 - CVE-2026-91202 - Don't de-reference a symlink when creating a directory RHEL-263134 - CVE-2026-91205 - Don't de-reference a symlink when creating a directory RHEL-263141...

ALSA-2026:84595 Moderate: cockpit-files security update

A filesystem browser for Cockpit Security Fixes: cockpit-files: cockpit-files: Arbitrary file ownership change via symlink following in privileged paste CVE-2026-91202 cockpit-files: cockpit-files: Local attacker can hijack file ownership via symlink race CVE-2026-91205 For more details about the...

Moderate: cockpit-files security update

A filesystem browser for Cockpit Security Fixes: cockpit-files: cockpit-files: Arbitrary file ownership change via symlink following in privileged paste CVE-2026-91202 cockpit-files: cockpit-files: Local attacker can hijack file ownership via symlink race CVE-2026-91205 For more details about the...

RHEL 9 : cockpit-files (RHSA-2026:84595)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:84595 advisory. A filesystem browser for Cockpit Security Fixes: cockpit-files: cockpit-files: Arbitrary file ownership change via symlink following in...

Fedora 43 : cockpit-files (2026-a643ae21d6)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a643ae21d6 advisory. Automatic update for cockpit-files-45-1.fc43. Changelog for cockpit-files Wed Sep 23 2026 Packit - 45-1 - Fixes CVE-2026-91202, CVE-2026-91203,...

Fedora 44 : cockpit-files (2026-d8f5999539)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-d8f5999539 advisory. Automatic update for cockpit-files-45-1.fc44. Changelog for cockpit-files Wed Sep 23 2026 Packit - 45-1 - Fixes CVE-2026-91202, CVE-2026-91203,...

Fedora 45 : cockpit-files (2026-f41fd82fcf)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-f41fd82fcf advisory. Automatic update for cockpit-files-45-1.fc45. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note...

SUSE CVE-2026-91202

A flaw was found in cockpit-files. A low-privileged local user can exploit this vulnerability by crafting a directory containing a symbolic link symlink and then using the privileged "Paste as owner" function. This allows for arbitrary file ownership changes outside the intended pasted directory,...

SUSE CVE-2026-91203

A flaw was found in cockpit-files. This vulnerability allows a local attacker to exploit a timing issue, known as a symlink race condition, during privileged file operations such as changing file ownership or permissions. By manipulating directory entries and winning this race, the attacker can...

SUSE CVE-2026-91205

A flaw was found in cockpit-files. A local unprivileged attacker can exploit a race condition during directory creation with owner assignment. By controlling a writable parent directory, the attacker can replace a newly created directory with a symbolic link symlink before the ownership change...