Cockpit Files CVE-2026-91202

Requires local access as a low-privileged user on a RHEL 9/10 system where cockpit-files is installed and used. The attacker must pre-stage a directory containing a symlink, and exploitation only completes when a more privileged operator invokes the 'Paste as owner' function AND actively selects a non-original owner (UI:R) - this operator interaction is the primary limiting factor. It is not remotely reachable (AV:L) and is bounded to hosts where the cockpit-files paste-as-owner workflow is actually used by administrators.

This is a genuine but locally-scoped privilege/integrity issue, not a high-urgency remote threat. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L, base 6.1) correctly reflects a local, low-privileged attacker who needs user interaction from a more privileged operator to complete the attack. There is no EPSS score, no CISA KEV listing, and no public exploit identified at time of analysis, so real-world exploitation pressure is low. The core risk is that arbitrary file ownership can be changed outside the intended target (CWE-61 symlink following), which is a strong integrity primitive (I:H) that can escalate toward broader compromise, but it is fundamentally gated by local access plus an administrator being tricked into selecting a non-original owner during a privileged 'Paste as owner' operation. Note a labeling conflict: the input Tags mark this 'Authentication Bypass,' which does not match the mechanism (symlink-following abuse of a privileged file operation) or CWE-61 - treat that tag as incorrect. Overall this is a legitimate defense-in-depth fix rather than an emergency patch item, and it is closely related to sibling CVE-2026-91203 (a TOCTOU race variant in the same component).

A low-privileged local user on a RHEL 9/10 host running cockpit-files stages a directory containing a symlink that points to a sensitive file outside the directory. When an administrator uses the privileged 'Paste as owner' feature and selects a non-original owner, the operation follows the symlink and changes ownership of the out-of-scope target file, handing the attacker control (and possibly read access) over it. No public exploit code is currently identified, and success depends on the operator choosing a non-original owner during the paste.