Junglewise Threat Intelligence

CVE-2026-54371: acl project attr symlink traversal in getfattr and setfattr

CVE-2026-54371 · Severity: high · CVSS 7.1 · Published 2026-06-29

Executive brief

The attr package, which provides tools for managing extended file attributes on Linux systems, contains a security flaw in its getfattr and setfattr utilities. A local attacker can use this flaw to trick a system administrator or a high-privilege automated process into modifying or reading the wrong files. This can lead to a complete takeover of the system by allowing the attacker to gain administrative privileges.

Technical details

A symlink traversal vulnerability (CWE-59) exists in the getfattr and setfattr utilities of the attr package prior to version 2.6.0. The flaw occurs during directory hierarchy traversal where the utilities fail to properly validate pathname components. A local attacker with low privileges can replace a directory component with a symbolic link while a privileged process is traversing the path. This race condition or improper link resolution allows the attacker to redirect file attribute operations to arbitrary files on the system, potentially leading to local privilege escalation (LPE). The issue is addressed in version 2.6.0.

Affected products

  • acl project attr before 2.6.0

Timeline

  • 2026-06-16: disclosed: Vulnerability details shared by VulnCheck
  • 2026-06-29: advisory: NVD publication date

References