Skip to main content

attr CVE-2026-54371

| EUVDEUVD-2026-40087 HIGH
Improper Link Resolution Before File Access (CWE-59)
2026-06-29 VulnCheck GHSA-hh95-r7mj-c9j5
Privilege Escalation Acl Acl Project
8.4
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
8.4 HIGH
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.3 MEDIUM

Local, authenticated user (AV:L/PR:L); symlink-swap during privileged traversal implies a race window (AC:H); redirecting reads/writes yields high confidentiality and integrity impact, no availability loss.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE
7.4 HIGH
AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat
6.3 MEDIUM
qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

1
Analysis Generated
Jun 29, 2026 - 14:20 vuln.today

DescriptionCVE.org

attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path.

AnalysisAI

Local privilege escalation in the attr package's getfattr and setfattr utilities (versions before 2.6.0) allows an attacker who controls a pathname component to swap it for a symbolic link during directory hierarchy traversal, redirecting attribute operations to arbitrary files. When these utilities are invoked by a privileged process over an attacker-influenced path, the attacker can read or write extended attributes on files outside their authority, leading to escalation to higher privileges. The flaw was reported by VulnCheck; no public exploit has been identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

The attr package (CPE cpe:2.3:a:acl_project:acl) provides the userspace getfattr/setfattr tools for reading and setting Linux extended attributes (xattrs) on filesystem objects. The root cause is CWE-59 (Improper Link Resolution Before File Access, 'Link Following'): when these utilities recurse through a directory hierarchy, they resolve each pathname component without guarding against a component being replaced by a symlink mid-traversal, a classic TOCTOU/symlink-following weakness. Because the operation follows the symlink to its target, an attacker who controls any intermediate component can redirect the privileged tool to a file of their choosing rather than the intended path.

RemediationAI

Vendor-released patch: upgrade attr to version 2.6.0 or later, which corrects the symlink handling during directory traversal; the upstream fix commits are at https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=c440855d6b33446edf4b5eb1a2d892281f15a99b and .../commit/?id=49f79e947270f06940b9100fa638f85dddc4aa7f. On managed systems, apply the distribution's updated attr package (which may backport the fix to an earlier version string) rather than building from source. Until patched, avoid running getfattr/setfattr recursively as root or any privileged user over directory trees that unprivileged users can write to, and where such operations are unavoidable, restrict write/ownership of intermediate directories so attackers cannot insert symlink components; the trade-off is that recursive xattr management on shared or user-writable directories must be paused or sandboxed, which can disrupt backup and migration workflows that rely on these tools. Review the VulnCheck advisory (https://www.vulncheck.com/advisories/attr-symlink-traversal-privilege-escalation-via-getfattr-setfattr) for vendor guidance.

More in Acl

View all
CVE-2018-25320 CRITICAL POC
9.3 May 17

ACL Analytics versions 11.x through 13.0.0.579 contain an arbitrary code execution vulnerability that allows attackers t
CVE-2026-54369 HIGH
8.4 Jun 29

Local privilege escalation in the Linux acl utilities (libacl) before version 2.4.0 arises because the pathname-based fu
CVE-2026-54370 HIGH
7.2 Jun 29

Local privilege escalation in the Linux acl package (libacl/getfacl/setfacl/chacl) before version 2.4.0 lets an unprivil

Same weakness CWE-59 – Improper Link Resolution Before File Access

View all
CVE-2020-0787 HIGH POC
7.8
CVE-2015-1130 HIGH POC
7.8
CVE-2015-5287 HIGH POC
7.8
CVE-2026-41091 HIGH POC
7.8
CVE-2019-1069 HIGH POC
7.8
CVE-2026-81963 HIGH POC
7.8
CVE-2016-6664 HIGH POC
7.0
CVE-2025-60710 HIGH POC
7.8

Same technique Privilege Escalation

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2024-9474 MEDIUM POC
6.9
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected

Share

CVE-2026-54371 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy