RLSA-2026:97538: Important: cockpit-files security update
A filesystem browser for Cockpit
Security Fix(es):
lodash: lodash: Arbitrary code execution via untrusted input in template imports (CVE-2026-4800)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Rocky Linux 9 Release Notes linked from the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/cockpit-filesto a version that resolves this vulnerability.Fixed in 0:43-1.el9
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The issue is described as arbitrary code execution via untrusted input in lodash template imports. The advisory assigns Network attack vector, no privileges required, and no user interaction required, although it also rates attack complexity as high.
What is the potential impact if exploitation succeeds?
The advisory rates the issue high with a CVSS score of 8.1. Its vector indicates high impacts to confidentiality, integrity, and availability.
Which software should be prioritized for remediation?
Prioritize Rocky Linux systems using the cockpit-files package, which is identified as the affected software in this advisory.