A flaw was found in Cockpit. A local authenticated user with control over a target account's home directory can exploit a privileged symlink dereferen...

A flaw was found in Cockpit. A local authenticated user with control over a target account's home directory can exploit a privileged symlink dereference vulnerability in the ssh-add-public-key.sh helper. When this helper runs with elevated privileges, it can be tricked into following attacker-controlled symlinks within the .ssh or authorized_keys paths. This allows the attacker to arbitrarily change file ownership and modes, potentially leading to local privilege escalation and impacting the integrity, confidentiality, and availability of the system.