CVE-2026-91202

A flaw was found in cockpit-files. A low-privileged local user can exploit this vulnerability by crafting a directory containing a symbolic link (symlink) and then using the privileged "Paste as owner" function. This allows for arbitrary file ownership changes outside the intended pasted directory, leading to a compromise of data integrity. In some cases, this could also lead to reduced confidentiality if the new ownership grants unauthorized read access. Exploitation requires user interaction to select a non-original owner during the paste operation.

This issue in cockpit-files allows a local, low-privileged user to change arbitrary file ownership via symlink following during a privileged paste operation. Exploitation requires a crafted directory tree with symlinks, the use of the 'Paste as owner' feature in Cockpit with superuser mode, and user interaction to select a non-'original' owner, making it less straightforward to exploit than an Important issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

A workaround is available for this issue: avoid using the privileged "Paste as owner" option in cockpit-files when pasting copied directory trees that may contain symlinks. If a privileged paste is required, keep the owner selection at "original", which skips the recursive chown code path entirely and prevents ownership changes from following symlinks to files outside the pasted directory. Once updated cockpit-files packages containing the fix are available for the affected streams, installing them resolves the issue.