CVE-2026-91205

A flaw was found in cockpit-files. A local unprivileged attacker can exploit a race condition during directory creation with owner assignment. By controlling a writable parent directory, the attacker can replace a newly created directory with a symbolic link symlink before the ownership change...

CVE-2026-91203

A flaw was found in cockpit-files. This vulnerability allows a local attacker to exploit a timing issue, known as a symlink race condition, during privileged file operations such as changing file ownership or permissions. By manipulating directory entries and winning this race, the attacker can...

EUVD-2026-83298

A flaw was found in cockpit-files. A low-privileged local user can exploit this vulnerability by crafting a directory containing a symbolic link symlink and then using the privileged "Paste as owner" function. This allows for arbitrary file ownership changes outside the intended pasted directory,...

CVE-2026-91202

CVE-2026-91202 affects cockpit-files , a component of the Cockpit web-based server management suite. A low-privileged local user can exploit a symlink-following flaw in the privileged "Paste as owner" function by crafting a directory containing a symbolic link. This allows arbitrary file ownershi...

CVE-2026-91203

CVE-2026-91203 is a symlink race condition in cockpit-files that allows a local attacker with low privileges to redirect privileged file operations (such as changing file ownership or permissions) to unintended files by manipulating directory entries. This can lead to unauthorized modification of...

EUVD-2026-83296

A flaw was found in cockpit-files. This vulnerability allows a local attacker to exploit a timing issue, known as a symlink race condition, during privileged file operations such as changing file ownership or permissions. By manipulating directory entries and winning this race, the attacker can...

CVE-2026-91203 Cockpit-files: cockpit-files: arbitrary file ownership and permission modification via symlink race condition

A flaw was found in cockpit-files. This vulnerability allows a local attacker to exploit a timing issue, known as a symlink race condition, during privileged file operations such as changing file ownership or permissions. By manipulating directory entries and winning this race, the attacker can...

EUVD-2026-83291

A flaw was found in cockpit-files. A local unprivileged attacker can exploit a race condition during directory creation with owner assignment. By controlling a writable parent directory, the attacker can replace a newly created directory with a symbolic link symlink before the ownership change...

CVE-2026-91205 Cockpit-files: cockpit-files: local attacker can hijack file ownership via symlink race

A flaw was found in cockpit-files. A local unprivileged attacker can exploit a race condition during directory creation with owner assignment. By controlling a writable parent directory, the attacker can replace a newly created directory with a symbolic link symlink before the ownership change...

CVE-2026-91205

cockpit-files is vulnerable to a symlink race condition during directory creation with owner assignment. A local unprivileged attacker who controls a writable parent directory can replace a newly created directory with a symbolic link before the chown operation is applied, redirecting ownership c...

cockpit-files bug fix and enhancement update

An update is available for cockpit-files. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky Linu...