Skip to content
Heist/ feed
UnratedFix available

DEBIAN-CVE-2026-91203

Type: advisorySource: OSV1 source record

A flaw was found in cockpit-files. This vulnerability allows a local attacker to exploit a timing issue, known as a symlink race condition, during privileged file operations such as changing file ownership or permissions. By manipulating directory entries and winning this race, the attacker can redirect these operations to unintended files. This could lead to unauthorized changes in file ownership and permissions on arbitrary files, potentially compromising system integrity and availability by altering system or application states or rendering services unusable.

Announced Source revision 1
Original source ↗

DEBIAN-CVE-2026-91203

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:DEBIAN-CVE-2026-91203

cockpit-files

Source reference: /affected/0/package/name

Affected versions
36-1

Source reference: /affected/0/versions

36-1~bpo13+1

Source reference: /affected/0/versions

38-1

Source reference: /affected/0/versions

39-1

Source reference: /affected/0/versions

40-1

Source reference: /affected/0/versions

41-1

Source reference: /affected/0/versions

43-1

Source reference: /affected/0/versions

43-1~bpo13+1

Source reference: /affected/0/versions

44-1

Source reference: /affected/0/versions

44-1~bpo13+1

Source reference: /affected/0/versions

45-1~bpo13+1

Source reference: /affected/0/versions

Fixed versions
45-1

Source reference: /affected/0/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "45-1"
          }
        ]
      }
    ],
    "package": {
      "name": "cockpit-files",
      "purl": "pkg:deb/debian/cockpit-files?arch=source&distro=forky",
      "ecosystem": "Debian:14"
    },
    "versions": [
      "36-1",
      "36-1~bpo13+1",
      "38-1",
      "39-1",
      "40-1",
      "41-1",
      "43-1",
      "43-1~bpo13+1",
      "44-1",
      "44-1~bpo13+1",
      "45-1~bpo13+1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-91203.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  }
]

Publisher severity

No explicit severity was provided.

Event
#25953 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement