RHSA-2026:95570: Moderate: cockpit-files security update
Published Nov 5, 2026
·Updated
A filesystem browser for CockpitSecurity Fix(es): cockpit-files: cockpit-files: Arbitrary file ownership and permission modification via symlink race condition (CVE-2026-91203) cockpit-files: cockpit-files: Arbitrary file ownership change via symlink following in privileged paste (CVE-2026-91202) cockpit-files: cockpit-files: Local attacker can hijack file ownership via symlink race (CVE-2026-91205) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
18 affected componentsFixes available
Red Hat Red Hat Enterprise Linux for Power, little endian
Red Hat Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle
Red Hat Red Hat Enterprise Linux for x86_64 - 4 years of updates
Red Hat Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Red Hat Enterprise Linux for x86_64 - Extended Life Cycle
Red Hat Red Hat Enterprise Linux for Power, little endian - 4 years of support
Red Hat Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Red Hat Enterprise Linux for IBM z Systems - 4 years of updates
Red Hat Red Hat Enterprise Linux for ARM 64
Red Hat Red Hat Enterprise Linux for x86_64
Red Hat Red Hat Enterprise Linux for ARM 64 - 4 years of updates
Red Hat Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle
Red Hat Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle
Red Hat Red Hat Enterprise Linux for IBM z Systems
redhat/cockpit-files<36.1-1.el10_2
36.1-1.el10_2
redhat/cockpit-files<36.1-1.el10_2
36.1-1.el10_2
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/cockpit-filesto a version that resolves this vulnerability.Fixed in 36.1-1.el10_2
Event History
Nov 5, 2026
Advisory Published
via Red Hat·12:00 AM
Data Sourced
via Red Hat·12:00 AM
RemedyDescriptionAffected Software
Advisory Published
via Red Hat·01:57 PM
Data Sourced
via Red Hat·01:57 PM
Severity