CVE-2026-91205 in Cockpit
Summary
by MITRE • 09/18/2026
A flaw was found in cockpit-files. A local unprivileged attacker can exploit a race condition during directory creation with owner assignment. By controlling a writable parent directory, the attacker can replace a newly created directory with a symbolic link (symlink) before the ownership change operation (chown) is applied. This allows the attacker to redirect the ownership change to an arbitrary file, potentially leading to information disclosure or unauthorized modification of sensitive files.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified in cockpit-files represents a classic race condition rooted in improper handling of directory creation and subsequent permission management operations. Specifically, the flaw occurs during the process where new directories are created by unprivileged users within a context that requires specific ownership attributes to be applied immediately after creation. The core technical deficiency lies in the lack of atomicity between the system call used to create the directory and the subsequent chown operation intended to assign proper owner permissions. In Unix-like operating systems, file operations such as mkdir followed by chown are not inherently atomic unless explicitly managed through secure coding practices or specific kernel-level safeguards that prevent intermediate state manipulation. This gap creates a temporal window during which an attacker with local access can intervene in the execution flow of the privileged process managing these files.
An unprivileged attacker who has write permissions to a parent directory containing the target location for new directories can exploit this race condition by leveraging symbolic links, commonly known as symlinks. The attack vector involves the attacker pre-creating a symbolic link at the exact path where the vulnerable application intends to create its new directory. When the privileged process executes mkdir to establish the new directory structure, it typically follows standard conventions that may resolve paths or interact with existing filesystem entries depending on implementation details. However, if the system allows following symlinks during certain file operations or if the attacker can time their actions precisely, they can trick the chown operation into targeting the symlink rather than a newly created independent inode. Because symbolic links are often treated as distinct entities that point to other files, changing ownership of the link itself may not be restricted in the same way as changing ownership of regular files or directories owned by root, depending on kernel version and configuration.
The operational impact of this vulnerability is significant because it allows for arbitrary file ownership modification within the constraints of what the attacker can control via symlinks. By redirecting the chown operation to an arbitrary file that exists in a location accessible to the symlink target, the attacker effectively gains the ability to alter the owner and group attributes of sensitive system files or application data. This capability undermines the principle of least privilege by allowing unprivileged users to manipulate ownership metadata on resources they should not have control over. The consequences can range from information disclosure, where changing ownership might expose file contents if combined with other vulnerabilities like world-readable permissions being set subsequently, to unauthorized modification of sensitive configuration files or application data. If an attacker changes the owner of a critical service file to their own user account, they may later gain full read-write access to that file when the service runs under different assumptions about ownership security boundaries.
This vulnerability aligns with CWE-367, which describes Time-of-check to time-of-use (TOCTOU) race conditions, specifically involving filesystem operations where the state of a resource is checked and then used without ensuring it remains unchanged during the interval. It also maps to MITRE ATT&CK technique T1548.002, Abuse Elevation Control Mechanism, as it involves manipulating file ownership controls to bypass intended security restrictions. Furthermore, CWE-673, Use of Externally-Controlled File Path, is relevant because the attacker influences the target path through symlink manipulation in a writable parent directory. The exploitation relies on precise timing and filesystem behavior that varies across different operating system implementations, making it particularly dangerous as defenses may not be uniformly applied or understood by developers who assume standard POSIX semantics guarantee atomicity where none exists.
Mitigation strategies must focus on eliminating the race window entirely through secure coding practices. Developers should avoid performing separate stat-check-chown sequences and instead use functions that handle ownership assignment atomically during file creation, such as using umask combined with appropriate mode settings or utilizing platform-specific APIs designed for safe privilege management. If directory creation is necessary, ensuring that the application does not follow symlinks in parent directories by verifying path components against expected values can prevent redirection attacks. Additionally, implementing strict access controls on writable directories to limit which users can create entries reduces the attack surface. System administrators should also consider applying security modules like SELinux or AppArmor to restrict file ownership changes and symlink following behaviors for specific services, thereby adding a mandatory access control layer that complements discretionary permission models. Regular code audits focusing on filesystem interaction patterns are essential to identify similar TOCTOU vulnerabilities in other components of the software ecosystem.