Executive brief
Cockpit Files is a web-based file manager for Linux systems. A local user with low privileges can exploit a symlink-following flaw in the "Paste as owner" function to change ownership of arbitrary files on the system, compromising data integrity and potentially exposing sensitive files to unauthorized access. The attack requires the user to craft a directory with symlinks and interact with the paste dialog to select a different owner.
Technical details
The vulnerability is a symlink-following flaw (CWE-61) in Cockpit Files' privileged "Paste as owner" operation. A low-privileged local user can craft a directory tree containing symlinks that point outside the intended paste destination; when a privileged user pastes with owner selection via the web interface, the symlinks are followed, allowing arbitrary file ownership changes. Exploitation requires local filesystem access, superuser-mode paste operation, and user interaction to select a non-original owner.
Affected products
- Red Hat Cockpit Files
Timeline
- 2026-09-18: disclosed