A flaw in cockpit-files allows a local, low-privileged user to exploit symbolic link following during a privileged 'Paste as owner' operation. By crafting a directory tree containing symlinks and using the 'Paste as owner' feature in Cockpit with superuser mode, the attacker can change ownership of files outside the intended pasted directory. This leads to arbitrary file ownership changes, compromising data integrity and potentially confidentiality. Exploitation requires user interaction to select a non-original owner during the paste operation. The vulnerability is tracked as CVE-2026-91202 with a CVSS 3.1 score of 6.1 (medium severity).

The vulnerability allows a low-privileged local user to arbitrarily change file ownership outside the intended directory, which compromises data integrity. In some cases, this may also reduce confidentiality if the new ownership grants unauthorized read access. The attack requires user interaction and superuser mode, making exploitation less straightforward.

No official fix or patch is currently confirmed in the vendor advisory. Patch status is not yet confirmed — check the Red Hat advisory for current remediation guidance. Users should avoid using the 'Paste as owner' function with untrusted input or symbolic links until a fix is available. Monitoring Red Hat's advisory page for updates and applying patches once released is recommended.