Skip to main content

libacl (acl) CVE-2026-54369

| EUVDEUVD-2026-40085 HIGH
Improper Link Resolution Before File Access (CWE-59)
2026-06-29 VulnCheck GHSA-53ch-pxc8-6g72
Privilege Escalation Acl Acl Project
8.4
CVSS 4.0 · Vendor: VulnCheck
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Gain local unprivileged shell
  2. Delivery
    Identify privileged ACL operation on writable path
  3. Exploit
    Plant symlink at path component
  4. Execution
    Privileged libacl call follows symlink
  5. Persist
    ACL written to targeted sensitive file
  6. Impact
    Escalate to root privileges

Vulnerability Assessment

Weakness
CWE
CWE-59
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Symlink resolution safety
Exploitation Conditions

Exploitation requires (1) local access with at least an unprivileged account (PR:L), and (2) a higher-privileged caller - typically root or a setuid/daemon process - that invokes one of acl_get_file(), acl_set_file(), acl_extended_file(), or acl_delete_def_file() on a pathname whose components the attacker can influence. The concrete prerequisite is attacker write control over at least one directory component in a path that the privileged process will operate on, so the attacker can replace that component with a symlink. Limiting factors: it is local-only (no remote vector), needs an existing low-priv foothold, and requires the specific deployment pattern of a privileged ACL operation touching an attacker-writable path - systems where privileged ACL operations only occur on trusted, non-writable paths are not practically exploitable.
Impact

The provided CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N) scores 8.4 (High) and is internally consistent with the description: local vector, low complexity, low privileges required, no user interaction, with high confidentiality and integrity impact but no availability impact - matching an ACL-manipulation/privesc primitive rather than a crash. No EPSS score was provided and the CVE is not in CISA KEV, so there is no evidence of active or widespread exploitation; absence of EPSS limits probabilistic ranking. No POC was supplied in the intelligence. The real-world severity hinges on a precondition the CVSS vector cannot capture: a privileged caller must process an attacker-controlled pathname. Where that pattern exists (setuid tools, root cron/backup jobs touching world-writable dirs), this is a genuine privesc priority; where it does not, exploitability is limited. Treat as a meaningful but condition-dependent local privesc rather than an internet-facing emergency.
Exploit ScenarioDerived

A root-run backup or provisioning job applies ACLs with setfacl to files under a directory that a low-privileged user can write to. The attacker pre-plants a symbolic link at one of the path components pointing to a sensitive file such as /etc/shadow or a setuid binary's directory, so when the privileged process calls acl_set_file() the ACL change is redirected there, granting the attacker access and enabling privilege escalation. No public POC was identified at time of analysis, but the low attack complexity makes weaponization straightforward for an attacker who already has a local foothold.
Monitor Track and reassess. Why: Vendor states no customer action required.
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 29, 2026

Local privilege escalation in the Linux acl utilities (libacl) before version 2.4.0 arises because the pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() follow symbolic links during ACL read/write operations. An attacker who controls any component of a pathname processed by a privileged caller can substitute a symlink to redirect ACL operations to arbitrary files, manipulating access control lists outside their authority. No public exploit identified at time of analysis, and the issue is not in CISA KEV; risk is gated on a privileged process operating on attacker-influenced paths.

RemediationAI

Vendor-released patch: upgrade libacl/acl to version 2.4.0 or later, or to your distribution's backported package that incorporates commits 3589787cd589b34bdd9265936e17190b6d3f17d1 and 24a227d0ab8576612194f8a56c2314389adc74a5 (https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1), as described in the VulnCheck advisory (https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions). Until packages are updated, reduce exposure by auditing privileged processes that invoke setfacl/getfacl or libacl on paths inside attacker-writable directories and avoid running such operations against world-writable or untrusted-owned locations; where feasible, have privileged scripts resolve and validate the real path (or operate on a trusted fixed directory) before applying ACLs, and restrict write access to intermediate directories used by root-run jobs - noting these controls add operational friction and do not fully replace the library fix.

Affected VersionsENISA

acl 0 <2.4.0

Affected Packages

euvd acl fix: 2.4.0

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

libacl is the userspace library (shipped in the acl package on virtually every Linux distribution) that implements POSIX.1e access control lists via tools like getfacl/setfacl and is linked by many privileged daemons, backup utilities, and installers. The affected functions resolve a caller-supplied pathname and operate on whatever the final path component points to. The root cause is CWE-59 (Improper Link Resolution Before File Access, i.e. link following): these APIs do not use O_NOFOLLOW-style safe resolution or fd-based *at() semantics, so a symlink planted at any path component is dereferenced. The CPE cpe:2.3:a:acl_project:acl:*:*:*:*:*:*:*:* confirms the upstream nongnu/savannah 'acl' project itself is the affected component, fixed at 2.4.0.

Know when Acl gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (VulnCheck) PRIMARY 8.4 HIGH
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
vuln.today AI 7.1 HIGH

Local privesc primitive requiring an unprivileged foothold (PR:L), low complexity, no user interaction; high confidentiality and integrity impact via redirected ACL writes, with no availability impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE 7.4 HIGH
AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat 7.1 HIGH

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Local
Attack Complexity
Low
Attack Requirements
None
Privileges Required
Low
User Interaction
None
Vulnerable system: Confidentiality
High
Vulnerable system: Integrity
High
Vulnerable system: Availability
None
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
None

DescriptionCVE.org

acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.

Executive ViewAI

Why It Matters

The Linux ACL utilities library (libacl) versions before 2.4.0 contain a local privilege escalation vulnerability that allows system users to manipulate access control lists on arbitrary files. This impacts all Linux systems with privileged processes that perform ACL operations, potentially enabling data breach or privilege escalation. Immediate patching to version 2.4.0 is required to eliminate this privilege escalation vector.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.1%
Top 96% exploitable
Prevalence
Ubiquitous
libacl ships in essentially every mainstream Linux distribution
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
Vendor states no customer action required
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Small
Automatable
No
Human Impact
High
Technical Impact
Total

Priority Score

42
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +42
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.

More in Acl

View all
CVE-2018-25320 CRITICAL POC
9.3 May 17

ACL Analytics versions 11.x through 13.0.0.579 contain an arbitrary code execution vulnerability that allows attackers t
CVE-2026-54371 HIGH
8.4 Jun 29

Local privilege escalation in the attr package's getfattr and setfattr utilities (versions before 2.6.0) allows an attac
CVE-2026-54370 HIGH
7.2 Jun 29

Local privilege escalation in the Linux acl package (libacl/getfacl/setfacl/chacl) before version 2.4.0 lets an unprivil

Same weakness CWE-59 – Improper Link Resolution Before File Access

View all
CVE-2020-0787 HIGH POC
7.8
CVE-2015-1130 HIGH POC
7.8
CVE-2015-5287 HIGH POC
7.8
CVE-2026-41091 HIGH POC
7.8
CVE-2019-1069 HIGH POC
7.8
CVE-2026-81963 HIGH POC
7.8
CVE-2016-6664 HIGH POC
7.0
CVE-2025-60710 HIGH POC
7.8

Same technique Privilege Escalation

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2024-9474 MEDIUM POC
6.9
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Liberty Linux 10 Fixed
SUSE Liberty Linux 8 Fixed
SUSE Liberty Linux 9 Fixed
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected

References

Advisories & patches
PATCH https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-54369 ADVISORY https://vuldb.com/vuln/374621 REF https://access.redhat.com/errata/RHSA-2026:34351 REF https://access.redhat.com/errata/RHSA-2026:42736 REF https://access.redhat.com/errata/RHSA-2026:42739 REF https://access.redhat.com/errata/RHSA-2026:43420 REF https://access.redhat.com/errata/RHSA-2026:44481 REF https://access.redhat.com/errata/RHSA-2026:46836 REF https://access.redhat.com/errata/RHSA-2026:50205 REF https://access.redhat.com/errata/RHSA-2026:53371 REF https://access.redhat.com/errata/RHSA-2026:54769 REF https://access.redhat.com/errata/RHSA-2026:58981 REF https://access.redhat.com/errata/RHSA-2026:64805 REF https://access.redhat.com/errata/RHSA-2026:67140 REF https://access.redhat.com/errata/RHSA-2026:67142 REF https://access.redhat.com/errata/RHSA-2026:67144 REF https://access.redhat.com/security/cve/CVE-2026-54369 REF https://bugzilla.redhat.com/show_bug.cgi?id=2490277 REF https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json REF https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy