Red Hat Enterprise Linux (cockpit-files): Mehrere Schwachstellen ermöglichen Manipulation von Dateien

Summary

Product

Vulnerabilities 3

• Medium 6.1
  CVE-2026-91202

  Cockpit-files: cockpit-files: arbitrary file ownership change via symlink following in privileged paste

  A flaw was found in cockpit-files. A low-privileged local user can exploit this vulnerability by crafting a directory containing a symbolic link (symlink) and then using the privileged "Paste as owner" function. This allows for arbitrary file ownership change…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 10 cockpit-files Linux Debian Ubuntu
  Sep 18, 2026
• Medium 6.0
  CVE-2026-91203

  Cockpit-files: cockpit-files: arbitrary file ownership and permission modification via symlink race condition

  A flaw was found in cockpit-files. This vulnerability allows a local attacker to exploit a timing issue, known as a symlink race condition, during privileged file operations such as changing file ownership or permissions. By manipulating directory entries and…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 10 cockpit-files Linux Debian Ubuntu
  Sep 18, 2026
• Medium 6.0
  CVE-2026-91205

  Cockpit-files: cockpit-files: local attacker can hijack file ownership via symlink race

  A flaw was found in cockpit-files. A local unprivileged attacker can exploit a race condition during directory creation with owner assignment. By controlling a writable parent directory, the attacker can replace a newly created directory with a symbolic link …

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 10 cockpit-files Linux Debian Ubuntu
  Sep 18, 2026

Revision history

1. 2026-11-11 #2

   Neue Updates von Red Hat aufgenommen

2. 2026-11-05 #1

   Initiale Fassung

References

• Red Hat Security Advisory RHSA-2026:95570 vom 2026-11-05
  https://access.redhat.com/errata/RHSA-2026:95570
• PoC für CVE-2026-91202
  https://bugzilla.redhat.com/show_bug.cgi?id=2465834
• PoC für CVE-2026-91203
  https://bugzilla.redhat.com/show_bug.cgi?id=2465632
• PoC für CVE-2026-91205
  https://bugzilla.redhat.com/show_bug.cgi?id=2466442
• Oracle Linux Security Advisory ELSA-2026-95570 vom 2026-11-06
  http://linux.oracle.com/errata/ELSA-2026-95570.html
• Rocky Linux Security Advisory RLSA-2026:95570 vom 2026-11-06
  https://errata.build.resf.org/RLSA-2026:95570
• Red Hat Security Advisory RHSA-2026:98458 vom 2026-11-11
  https://access.redhat.com/errata/RHSA-2026:98458
• Red Hat Security Advisory RHSA-2026:98566 vom 2026-11-11
  https://access.redhat.com/errata/RHSA-2026:98566