Summary
[36.1-1]
- Fix CVE-2026-91202 - Don't de-reference a symlink when pasting (RHEL-263140)
- Fix CVE-2026-91205 - Don't de-reference a symlink when creating a directory (RHEL-263132)
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 10 | cockpit-files | 0:36.1-1.el10_2 |
Vulnerabilities 3
-
Medium 6.1
Cockpit-files: cockpit-files: arbitrary file ownership change via symlink following in privileged paste
A flaw was found in cockpit-files. A low-privileged local user can exploit this vulnerability by crafting a directory containing a symbolic link (symlink) and then using the privileged "Paste as owner" function. This allows for arbitrary file ownership change…
-
Medium 6.0
Cockpit-files: cockpit-files: arbitrary file ownership and permission modification via symlink race condition
A flaw was found in cockpit-files. This vulnerability allows a local attacker to exploit a timing issue, known as a symlink race condition, during privileged file operations such as changing file ownership or permissions. By manipulating directory entries and…
-
Medium 6.0
Cockpit-files: cockpit-files: local attacker can hijack file ownership via symlink race
A flaw was found in cockpit-files. A local unprivileged attacker can exploit a race condition during directory creation with owner assignment. By controlling a writable parent directory, the attacker can replace a newly created directory with a symbolic link …