CVE-2026-91202: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-91202 is a UNIX symbolic link (symlink) following vulnerability in cockpit-files that allows a low-privileged local user to cause arbitrary file ownership changes outside the intended paste directory. The flaw exists in the privileged "Paste as owner" function within the pasteAsOwner() flow in src/dialogs/copyPasteOwnership.tsx. The affected component is cockpit-files-36-1.el10 on Red Hat Enterprise Linux 10. It was reported on May 4, 2026, and publicly disclosed on September 18, 2026, with a CVSS v3.1 base score of 6.1 (Medium) (Red Hat CVE, Github Advisory).

The root cause is classified as CWE-61 (UNIX Symbolic Link Following). In the pasteAsOwner() function, when a user selects a non-original owner during a privileged paste operation, the code invokes chown --recursive via cockpit.spawn() with superuser: "require" — but without the --no-dereference flag. On GNU chown, the default behavior is to dereference symlinks, meaning if the pasted directory tree contains a symlink pointing to a file outside the tree (e.g., /etc/shadow), the recursive chown will change ownership of the symlink's target rather than the symlink itself. The attack requires a local user to craft a directory containing a symlink, copy it in the Cockpit Files UI, and trigger a privileged paste with a non-original owner selection (Red Hat Bugzilla).

Successful exploitation allows a low-privileged local user to change ownership of arbitrary files on the system — including sensitive files like /etc/shadow — to an attacker-controlled user, constituting a high-integrity impact. In cases where the ownership change grants the attacker read access to previously restricted files, confidentiality is also reduced. Availability impact is low but possible if ownership changes disrupt access to critical system files. The scope is limited to the local host (Red Hat CVE, Red Hat Bugzilla).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the disclosure date. The EPSS score is 0.0, indicating very low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires multiple preconditions: local access, a crafted symlink directory tree, a privileged Cockpit session with superuser mode, and user interaction to confirm a non-original owner selection, making opportunistic exploitation unlikely (Red Hat CVE, Github Advisory).

1. Prepare the malicious directory tree: As a low-privileged local user, create a directory containing a symlink pointing to a sensitive target file outside the intended scope, e.g., mkdir -p /tmp/src/evil && ln -s /etc/shadow /tmp/src/evil/link_to_shadow.
2. Copy the directory in Cockpit Files: Open the Cockpit Files web UI, navigate to /tmp/src, and copy the evil directory to the clipboard.
3. Navigate to a privileged destination: Navigate to a destination directory where unprivileged paste would fail but superuser mode is available in Cockpit.
4. Trigger privileged paste: Initiate the paste operation; when the "Paste as owner" dialog appears, select any owner other than original and confirm.
5. Verify ownership change: Check whether the symlink referent's ownership was changed, e.g., stat -c '%U:%G %n' /etc/shadow. If the ownership now reflects the selected user, the exploit succeeded.
6. Leverage changed ownership: Use the newly granted ownership to read, modify, or abuse the affected file for privilege escalation or data exfiltration (Red Hat Bugzilla).

• File System: Unexpected ownership changes on sensitive files (e.g., /etc/shadow, /etc/passwd, or other system files) detectable via stat or file integrity monitoring tools; presence of crafted directories with symlinks in world-writable locations such as /tmp.
• Logs: Cockpit audit logs or system journal entries (journalctl) showing privileged chown --recursive commands executed via cockpit-ws or cockpit-bridge on paths outside the intended paste destination; sudo or superuser escalation events tied to Cockpit sessions.
• Process: Unexpected chown processes spawned as root with arguments referencing /tmp source paths or sensitive system file paths (Red Hat Bugzilla).

The proposed fix is to add the --no-dereference flag to the privileged recursive chown invocation in src/dialogs/copyPasteOwnership.tsx, ensuring ownership changes apply only to symlink objects rather than their referents. As of the disclosure date, no released package fix is available for cockpit-files-36-1.el10. The recommended interim workaround is to avoid using "Paste as owner" on copied directory trees that may contain symlinks; if privileged paste is required, keep the owner selection set to original, which bypasses the vulnerable chown code path entirely (Red Hat CVE, Red Hat Bugzilla).

The vulnerability was discovered by AISLE Research in partnership with Red Hat and reported through Red Hat's coordinated disclosure process. Red Hat's Product Security team classified the issue as Moderate severity, noting that the multiple preconditions (local access, crafted symlink tree, privileged paste workflow, and user interaction) make it materially less straightforward to exploit than a typical Important-rated issue. No significant broader media coverage or notable community commentary has been identified beyond the official Red Hat advisory and Bugzilla report (Red Hat CVE, Red Hat Bugzilla).