RLSA-2026:98458: Moderate: cockpit-files security update
A filesystem browser for Cockpit
Security Fix(es):
cockpit-files: cockpit-files: Arbitrary file ownership change via symlink following in privileged paste (CVE-2026-91202)
cockpit-files: cockpit-files: Local attacker can hijack file ownership via symlink race (CVE-2026-91205)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/cockpit-filesto a version that resolves this vulnerability.Fixed in 0:43.1-1.el9_9
Event History
Frequently Asked Questions
Who can exploit these issues?
A local attacker with low privileges can exploit them. The CVSS vector also indicates user interaction is required.
What is the impact of successful exploitation?
Successful exploitation can allow arbitrary file ownership changes or hijacking of file ownership through symlink following or a symlink race during privileged paste operations.
Which component should be updated?
Update the Rocky Linux cockpit-files package. The advisory identifies fixes for CVE-2026-91202 and CVE-2026-91205.