Orta CVSS 6.1
CVE-2026-91202: CVE-2026-91202: güvenlik açığı
Açıklama (NVD)
A flaw was found in cockpit-files. A low-privileged local user can exploit this vulnerability by crafting a directory containing a symbolic link (symlink) and then using the privileged "Paste as owner" function. This allows for arbitrary file ownership changes outside the intended pasted directory, leading to a compromise of data integrity. In some cases, this could also lead to reduced confidentiality if the new ownership grants unauthorized read access. Exploitation requires user interaction to select a non-original owner during the paste operation.
Özet bilgiler
- CVSS v3.1
- 6.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L - EPSS
- %0,13 (yüzdelik 2)
- CWE
- CWE-61
- Yama
- Yok / bilinmiyor