Executive brief
Cockpit-Files is a web-based file manager for Linux systems. A local attacker with unprivileged access can exploit a race condition in directory creation to change the ownership of arbitrary files on the system, potentially exposing sensitive data or modifying critical configuration files. The attack requires the attacker to control the parent directory and wait for a specific window during the ownership change operation.
Technical details
A race condition in cockpit-files' directory creation with owner assignment (chown) allows a local unprivileged attacker to replace a newly created directory with a symlink before ownership is applied, redirecting the chown operation to an arbitrary file. The vulnerability requires local access, controlled writable parent directory, and precise timing; successful exploitation results in arbitrary file ownership modification leading to information disclosure or unauthorized modification.
Affected products
- Cockpit Project Cockpit-Files
Timeline
- 2026-09-18: disclosed