---
id: CVE-2026-91205
title: A flaw was found in cockpit-files
summary: >-
  A flaw was found in cockpit-files. A local unprivileged attacker can exploit a
  race condition during directory creation with owner assignment. By controlling
  a writable parent directory, the attacker can replace a newly created
  directory…
severity: medium
cvss: 6
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N'
cwe:
  - CWE-363
vendor: Red Hat
product: cockpit-files
affected:
  - cockpit-files (all versions)
  - cockpit-files (all versions)
published: '2026-09-18'
updated: '2026-09-22'
sourceUpdated: '2026-09-22T19:37:36.747'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-91205'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-91205'
    label: secalert@redhat.com
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2466442'
    label: secalert@redhat.com
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91205.json
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-91205'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-91205'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00105
epssPercentile: 0.00976
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-21T20:05:41.156298Z'
ingestedAt: '2026-09-18T19:49:30.597Z'
---

## Overview

A flaw was found in cockpit-files. A local unprivileged attacker can exploit a race condition during directory creation with owner assignment. By controlling a writable parent directory, the attacker can replace a newly created directory with a symbolic link (symlink) before the ownership change operation (chown) is applied. This allows the attacker to redirect the ownership change to an arbitrary file, potentially leading to information disclosure or unauthorized modification of sensitive files.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10 · updated 2026-09-22 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91205.json)