Skip to content
Heist/ feed
Back to feed
MediumFix available

cockpit-files — security advisory

Type: advisorySources: OSVAdvisory ID: DEBIAN-CVE-2026-91205

A flaw was found in cockpit-files. A local unprivileged attacker can exploit a race condition during directory creation with owner assignment. By controlling a writable parent directory, the attacker can replace a newly created directory with a symbolic link (symlink) before the ownership change operation (chown) is applied. This allows the attacker to redirect the ownership change to an arbitrary file, potentially leading to information disclosure or unauthorized modification of sensitive files.

Products
cockpit-files
Affected versions
36-1, 36-1~bpo13+1, 38-1, 39-1, 40-1, 41-1, 43-1, 43-1~bpo13+1, 44-1, 44-1~bpo13+1, 45-1~bpo13+1
Fixed versions
45-1
CVEs
CVE-2026-91205
Confirmed fixed CVEs
Not specified
Updated in this feed
31 Oct 2026, 22:37 UTC · Revision 1

Source evidence

DEBIAN-CVE-2026-91205

core-osv · Original source

Published 18 Sept 2026, 20:17 UTC

A flaw was found in cockpit-files. A local unprivileged attacker can exploit a race condition during directory creation with owner assignment. By controlling a writable parent directory, the attacker can replace a newly created directory with a symbolic link (symlink) before the ownership change operation (chown) is applied. This allows the attacker to redirect the ownership change to an arbitrary file, potentially leading to information disclosure or unauthorized modification of sensitive files.

osv:DEBIAN-CVE-2026-91205

cockpit-files

Fixed versions: 45-1

Complete source record
{
  "id": "6367f90c4ff51588b0165dacc338dcc280f39665bc4e08402d787c3d9a163d53",
  "url": "https://osv.dev/vulnerability/DEBIAN-CVE-2026-91205",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "DEBIAN-CVE-2026-91205",
    "summary": "A flaw was found in cockpit-files. A local unprivileged attacker can exploit a race condition during directory creation with owner assignment. By controlling a writable parent directory, the attacker can replace a newly created directory with a symbolic link (symlink) before the ownership change operation (chown) is applied. This allows the attacker to redirect the ownership change to an arbitrary file, potentially leading to information disclosure or unauthorized modification of sensitive files.",
    "evidence": "osv:DEBIAN-CVE-2026-91205",
    "products": [
      {
        "name": {
          "value": "cockpit-files",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "45-1",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": [
          {
            "value": "36-1",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "36-1~bpo13+1",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "38-1",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "39-1",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "40-1",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "41-1",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "43-1",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "43-1~bpo13+1",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "44-1",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "44-1~bpo13+1",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "45-1~bpo13+1",
            "evidence": "/affected/0/versions"
          }
        ]
      }
    ],
    "severity": "medium",
    "structured": {
      "id": "DEBIAN-CVE-2026-91205",
      "aliases": [
        "DEBIAN-CVE-2026-91205"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "45-1"
                }
              ]
            }
          ],
          "package": {
            "name": "cockpit-files",
            "purl": "pkg:deb/debian/cockpit-files?arch=source&distro=forky",
            "ecosystem": "Debian:14"
          },
          "versions": [
            "36-1",
            "36-1~bpo13+1",
            "38-1",
            "39-1",
            "40-1",
            "41-1",
            "43-1",
            "43-1~bpo13+1",
            "44-1",
            "44-1~bpo13+1",
            "45-1~bpo13+1"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-91205.json"
          },
          "ecosystem_specific": {
            "urgency": "not yet assigned"
          }
        }
      ],
      "modified": "2026-10-23T17:47:26.100017080Z",
      "provider": "osv",
      "upstream": [
        "CVE-2026-91205"
      ],
      "references": [
        "https://security-tracker.debian.org/tracker/CVE-2026-91205"
      ]
    },
    "related_cves": [
      {
        "value": "CVE-2026-91205",
        "evidence": "/upstream"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 416904,
  "published_at": "2026-09-18T20:17:29.533+00:00"
}