A flaw was found in Cockpit. A local authenticated user with control over a target account's home directory can exploit a privileged symlink dereference vulnerability in the "ssh-add-public-key.sh" helper. When this helper runs with elevated privileges, it can be tricked into following attacker-controlled symlinks within the ".ssh" or "authorized_keys" paths. This allows the attacker to arbitrarily change file ownership and modes, potentially leading to local privilege escalation and impacting the integrity, confidentiality, and availability of the system.