CVE-2026-91202

Name of the Vulnerable Software and Affected Versions cockpit-files versions prior to 44-1.1

Description A flaw in the "Paste as owner" function allows a low-privileged local user to change arbitrary file ownership outside the intended directory. This is achieved by crafting a directory containing a symbolic link (symlink), which is a special type of file that points to another file or directory. Exploitation requires user interaction to select a non-original owner during the paste operation, potentially compromising data integrity and reducing confidentiality if unauthorized read access is granted.

Recommendations Update to version 44-1.1.