CVE-2026-91203 — Katalog CVE

csirt@kutim:~/threat-intel/cve/CVE-2026-91203

CVSS 6.0 · Medium EPSS 0,11%

Kerentanan Race Condition Enabling Link Following. Skor CVSS 3.1 6.0 (Medium) menurut redhat.com.

Deskripsi (NVD)

A flaw was found in cockpit-files. This vulnerability allows a local attacker to exploit a timing issue, known as a symlink race condition, during privileged file operations such as changing file ownership or permissions. By manipulating directory entries and winning this race, the attacker can redirect these operations to unintended files. This could lead to unauthorized changes in file ownership and permissions on arbitrary files, potentially compromising system integrity and availability by altering system or application states or rendering services unusable.

Rincian

Terbit di NVD: 18 September 2026
Terakhir diubah: 22 September 2026
Status NVD: Awaiting Analysis
CVSS 3.1: 6.0 (Medium), sumber redhat.com
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-363: Race Condition Enabling Link Following
EPSS (30 hari): 0,11% peluang dieksploitasi; lebih tinggi dari 1,2% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.