RLSA-2026:97194: Important: cockpit-files security update
A filesystem browser for Cockpit
Security Fix(es):
lodash: lodash: Arbitrary code execution via untrusted input in template imports (CVE-2026-4800)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Rocky Linux 10 Release Notes linked from the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/cockpit-filesto a version that resolves this vulnerability.Fixed in 0:43-1.el10
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems running the Rocky Linux cockpit-files package are affected by this security update. The advisory identifies the underlying issue in lodash, but does not specify affected package versions or configurations.
What does an attacker need to exploit the vulnerability?
The issue involves arbitrary code execution through untrusted input in lodash template imports. The advisory does not state which application inputs reach the vulnerable functionality or provide further exploitation prerequisites.
Is a default cockpit-files installation affected?
The advisory does not say whether the vulnerable lodash template-import path is enabled or reachable in a default cockpit-files configuration.
What mitigation is available if the update cannot be applied immediately?
No workaround or temporary mitigation is provided in the advisory. The documented remediation is to apply the cockpit-files security update.