CVE-2026-91202

CVE Details

Release Date:	2026-09-18
Impact:	Moderate	What is this?

Description

A flaw was found in cockpit-files. A low-privileged local user can exploit this vulnerability by crafting a directory containing a symbolic link (symlink) and then using the privileged "Paste as owner" function. This allows for arbitrary file ownership changes outside the intended pasted directory, leading to a compromise of data integrity. In some cases, this could also lead to reduced confidentiality if the new ownership grants unauthorized read access. Exploitation requires user interaction to select a non-original owner during the paste operation.

See more information about CVE-2026-91202 from MITRE CVE dictionary and NIST NVD

NOTE: The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 metrics

Base Score:	6.1
Vector String:	CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L
Version:	3.1
Attack Vector:	Local
Attack Complexity:	Low
Privileges Required:	Low
User Interaction:	Required
Scope:	Unchanged
Confidentiality Impact:	Low
Integrity Impact:	High
Availability Impact:	Low

Errata information

Platform	Errata	Release Date
Oracle Linux version 9 (cockpit-files)	ELSA-2026-84595	2026-10-19