{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for cockpit-files is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "A filesystem browser for Cockpit\n\nSecurity Fix(es):\n\n* cockpit-files: cockpit-files: Arbitrary file ownership change via symlink following in privileged paste (CVE-2026-91202)\n\n* cockpit-files: cockpit-files: Local attacker can hijack file ownership via symlink race (CVE-2026-91205)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:98458",
        "url": "https://access.redhat.com/errata/RHSA-2026:98458"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "2465834",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2465834"
      },
      {
        "category": "external",
        "summary": "2466442",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466442"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_98458.json"
      }
    ],
    "title": "Red Hat Security Advisory: cockpit-files security update",
    "tracking": {
      "current_release_date": "2026-11-11T19:08:42+00:00",
      "generator": {
        "date": "2026-11-11T19:08:42+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.5"
        }
      },
      "id": "RHSA-2026:98458",
      "initial_release_date": "2026-11-11T12:55:41+00:00",
      "revision_history": [
        {
          "date": "2026-11-11T12:55:41+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-11-11T12:55:41+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-11-11T19:08:42+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream (v. 9)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream (v. 9)",
                  "product_id": "AppStream-9.9.0.Z.MAIN",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_linux:9::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cockpit-files-0:43.1-1.el9_9.noarch",
                "product": {
                  "name": "cockpit-files-0:43.1-1.el9_9.noarch",
                  "product_id": "cockpit-files-0:43.1-1.el9_9.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cockpit-files@43.1-1.el9_9?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cockpit-files-0:43.1-1.el9_9.src",
                "product": {
                  "name": "cockpit-files-0:43.1-1.el9_9.src",
                  "product_id": "cockpit-files-0:43.1-1.el9_9.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cockpit-files@43.1-1.el9_9?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cockpit-files-0:43.1-1.el9_9.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.9.0.Z.MAIN:cockpit-files-0:43.1-1.el9_9.noarch"
        },
        "product_reference": "cockpit-files-0:43.1-1.el9_9.noarch",
        "relates_to_product_reference": "AppStream-9.9.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cockpit-files-0:43.1-1.el9_9.src as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.9.0.Z.MAIN:cockpit-files-0:43.1-1.el9_9.src"
        },
        "product_reference": "cockpit-files-0:43.1-1.el9_9.src",
        "relates_to_product_reference": "AppStream-9.9.0.Z.MAIN"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2026-91202",
      "cwe": {
        "id": "CWE-61",
        "name": "UNIX Symbolic Link (Symlink) Following"
      },
      "discovery_date": "2026-05-04T16:26:35+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2465834"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in cockpit-files. A low-privileged local user can exploit this vulnerability by crafting a directory containing a symbolic link (symlink) and then using the privileged \"Paste as owner\" function. This allows for arbitrary file ownership changes outside the intended pasted directory, leading to a compromise of data integrity. In some cases, this could also lead to reduced confidentiality if the new ownership grants unauthorized read access. Exploitation requires user interaction to select a non-original owner during the paste operation.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "cockpit-files: cockpit-files: Arbitrary file ownership change via symlink following in privileged paste",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue in `cockpit-files` allows a local, low-privileged user to change arbitrary file ownership via symlink following during a privileged paste operation. Exploitation requires a crafted directory tree with symlinks, the use of the \u0027Paste as owner\u0027 feature in Cockpit with superuser mode, and user interaction to select a non-\u0027original\u0027 owner, making it less straightforward to exploit than an Important issue.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.9.0.Z.MAIN:cockpit-files-0:43.1-1.el9_9.noarch",
          "AppStream-9.9.0.Z.MAIN:cockpit-files-0:43.1-1.el9_9.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-91202"
        },
        {
          "category": "external",
          "summary": "RHBZ#2465834",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2465834"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-91202",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-91202"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91202",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91202"
        }
      ],
      "release_date": "2026-09-18T16:33:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-11T12:55:41+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.9.0.Z.MAIN:cockpit-files-0:43.1-1.el9_9.noarch",
            "AppStream-9.9.0.Z.MAIN:cockpit-files-0:43.1-1.el9_9.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:98458"
        },
        {
          "category": "workaround",
          "details": "A workaround is available for this issue: avoid using the privileged \"Paste as owner\" option in cockpit-files when pasting copied directory trees that may contain symlinks. If a privileged paste is required, keep the owner selection at \"original\", which skips the recursive chown code path entirely and prevents ownership changes from following symlinks to files outside the pasted directory. Once updated cockpit-files packages containing the fix are available for the affected streams, installing them resolves the issue.",
          "product_ids": [
            "AppStream-9.9.0.Z.MAIN:cockpit-files-0:43.1-1.el9_9.noarch",
            "AppStream-9.9.0.Z.MAIN:cockpit-files-0:43.1-1.el9_9.src"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.9.0.Z.MAIN:cockpit-files-0:43.1-1.el9_9.noarch",
            "AppStream-9.9.0.Z.MAIN:cockpit-files-0:43.1-1.el9_9.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "cockpit-files: cockpit-files: Arbitrary file ownership change via symlink following in privileged paste"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "AISLE Research"
          ],
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2026-91205",
      "cwe": {
        "id": "CWE-363",
        "name": "Race Condition Enabling Link Following"
      },
      "discovery_date": "2026-05-04T18:07:17+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2466442"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in cockpit-files. A local unprivileged attacker can exploit a race condition during directory creation with owner assignment. By controlling a writable parent directory, the attacker can replace a newly created directory with a symbolic link (symlink) before the ownership change operation (chown) is applied. This allows the attacker to redirect the ownership change to an arbitrary file, potentially leading to information disclosure or unauthorized modification of sensitive files.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "cockpit-files: cockpit-files: Local attacker can hijack file ownership via symlink race",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A moderate severity symlink race condition was found in cockpit-files, which affects the cockpit-files package as shipped in Red Hat Enterprise Linux 9 and 10, Red Hat In-Vehicle OS, and Fedora. When a user creates a directory with an owner assignment through Cockpit Files, the privileged directory creation (mkdir) and ownership change (chown) are performed as two separate operations on the same pathname. A local unprivileged attacker who can write to the parent directory can replace the newly created directory entry with a symlink in the window between the two operations, redirecting the privileged ownership change onto an arbitrary file of the attacker\u0027s choosing. If the race is won, ownership of sensitive files such as /etc/shadow can be transferred to the attacker, resulting in information disclosure or unauthorized modification of those files. Exploitation is materially constrained: it requires local access, an attacker-writable parent directory, user interaction to trigger the directory-creation flow with owner assignment, and winning the race window. This is reflected in the CVSS 3.1 score of 6.0 (AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N), which is consistent between Red Hat and the upstream CVE record. A fix is being pursued for the actively maintained Red Hat Enterprise Linux and Fedora releases. For the deferred streams (RHEL 9.6.z, RHEL 10.0.z, and the Red Hat In-Vehicle OS streams), the fix is deferred given the moderate severity and the practical difficulty of exploitation; the residual risk is limited to systems where untrusted local users have write access to directories used as parents for the privileged owner-assignment flow.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.9.0.Z.MAIN:cockpit-files-0:43.1-1.el9_9.noarch",
          "AppStream-9.9.0.Z.MAIN:cockpit-files-0:43.1-1.el9_9.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-91205"
        },
        {
          "category": "external",
          "summary": "RHBZ#2466442",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466442"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-91205",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-91205"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91205",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91205"
        }
      ],
      "release_date": "2026-09-18T16:33:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-11T12:55:41+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.9.0.Z.MAIN:cockpit-files-0:43.1-1.el9_9.noarch",
            "AppStream-9.9.0.Z.MAIN:cockpit-files-0:43.1-1.el9_9.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:98458"
        },
        {
          "category": "workaround",
          "details": "Avoid using the privileged owner-assignment directory-creation flow in Cockpit Files inside directories that are writable by untrusted local users. Restrict write permissions on shared parent directories, and where directories must remain shared and writable, apply the sticky bit so users cannot replace directory entries they do not own. Creating directories without an owner assignment does not trigger the vulnerable privileged chown path and can be used where the owner-setting feature is not required. Updated packages that address this flaw are being delivered for the actively maintained releases.",
          "product_ids": [
            "AppStream-9.9.0.Z.MAIN:cockpit-files-0:43.1-1.el9_9.noarch",
            "AppStream-9.9.0.Z.MAIN:cockpit-files-0:43.1-1.el9_9.src"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 6.0,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.9.0.Z.MAIN:cockpit-files-0:43.1-1.el9_9.noarch",
            "AppStream-9.9.0.Z.MAIN:cockpit-files-0:43.1-1.el9_9.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "cockpit-files: cockpit-files: Local attacker can hijack file ownership via symlink race"
    }
  ]
}