Hi,

The following vulnerability was published for cockpit-files.

CVE-2026-91203[0]:
| A flaw was found in cockpit-files. This vulnerability allows a local
| attacker to exploit a timing issue, known as a symlink race
| condition, during privileged file operations such as changing file
| ownership or permissions. By manipulating directory entries and
| winning this race, the attacker can redirect these operations to
| unintended files. This could lead to unauthorized changes in file
| ownership and permissions on arbitrary files, potentially
| compromising system integrity and availability by altering system or
| application states or rendering services unusable.

https://bugzilla.redhat.com/show_bug.cgi?id=2465632 is currently
the only reference, not sure if it has been reported upstream yet.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-91203
https://www.cve.org/CVERecord?id=CVE-2026-91203

Please adjust the affected versions in the BTS as needed.