This vulnerability in cockpit-files enables a local, low-privileged user to craft a directory containing symlinks and then use the privileged 'Paste as owner' function to change ownership of files outside the intended directory. The flaw arises from symlink following during the paste operation, leading to arbitrary file ownership changes. Exploitation requires user interaction to select a non-original owner during the paste, making it less straightforward. The issue impacts data integrity primarily and can also affect confidentiality if ownership changes grant unauthorized read access. The CVSS 3.1 base score is 6.1 (medium severity) with vector AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L. Red Hat is the authoritative source and has published an advisory detailing the issue.

A low-privileged local user can cause arbitrary file ownership changes outside the intended directory, compromising data integrity. In some cases, this may also reduce confidentiality by granting unauthorized read access. The vulnerability requires user interaction and use of the 'Paste as owner' feature with superuser privileges, limiting ease of exploitation. Availability impact is low.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-91202 for current remediation guidance. Exploitation requires user interaction and specific use of the 'Paste as owner' feature, so limiting use of this feature or restricting local user access may reduce risk. Monitor Red Hat advisories for updates on fixes or mitigations.