Skip to main content

attr CVE-2026-54371

| EUVDEUVD-2026-40087 HIGH
Improper Link Resolution Before File Access (CWE-59)
2026-06-29 VulnCheck GHSA-hh95-r7mj-c9j5
Privilege Escalation Acl Acl Project
8.4
CVSS 4.0 · Vendor: VulnCheck
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Obtain local user account
  2. Delivery
    Identify privileged getfattr/setfattr traversal over writable path
  3. Exploit
    Replace pathname component with symlink
  4. Execution
    Privileged process follows symlink to target file
  5. Persist
    Attribute operation redirected to attacker-chosen file
  6. Impact
    Escalate privileges

Vulnerability Assessment

Weakness
CWE
CWE-59
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Symlink resolution safety
Exploitation Conditions

Exploitation requires an authenticated local user (PR:L) who controls at least one intermediate pathname component of a path that a privileged process traverses using getfattr or setfattr - for example a user-writable subdirectory inside a tree that a root-owned script processes recursively. The attacker must be able to substitute that component with a symbolic link before/while the privileged getfattr/setfattr operation runs, and a higher-privileged process must actually invoke these utilities over the attacker-controlled path. Limiting factors: it is purely local (no remote/network exploitation), it requires a prior local account, it depends on a privileged process invoking these specific tools over an attacker-influenced path (not a default behavior of an idle system), and there is no user-interaction requirement (UI:N) but there is an environmental precondition that such a privileged traversal exists.
Impact

The provided CVSS 4.0 base score is 8.4 (High) with vector AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N - local vector, low complexity, low privileges required, no user interaction, with high confidentiality and integrity impact but no availability impact, consistent with a privilege-escalation primitive rather than remote compromise. There is no EPSS score, no KEV listing, and no published proof-of-concept in the provided data, so this is a credible but not actively-exploited issue (no public exploit identified at time of analysis). The realistic risk is moderate-to-high: exploitation depends on a privileged process actually invoking getfattr/setfattr over a path that crosses attacker-controlled directories (e.g., backup, indexing, or admin scripts), which is a real but environment-specific precondition rather than a guaranteed default-config attack. One caveat: symlink-swap traversal flaws often involve a race window, which could argue for higher attack complexity than the AC:L in the supplied vector - defenders should treat AC:L as the vendor/reporter assessment, not independently confirmed.
Exploit ScenarioDerived

A low-privileged local user identifies a privileged process - such as a root-run backup, restore, or attribute-migration script - that invokes getfattr or setfattr recursively over a directory the user can write to. The user replaces an intermediate pathname component with a symbolic link pointing to a sensitive file (or to a path where setting attributes grants escalated access), so when the privileged tool traverses the path it follows the symlink and operates on the attacker-chosen target, yielding privilege escalation. No public proof-of-concept is identified at time of analysis, and exploitation requires the local account plus a privileged consumer of these utilities.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 29, 2026

Local privilege escalation in the attr package's getfattr and setfattr utilities (versions before 2.6.0) allows an attacker who controls a pathname component to swap it for a symbolic link during directory hierarchy traversal, redirecting attribute operations to arbitrary files. When these utilities are invoked by a privileged process over an attacker-influenced path, the attacker can read or write extended attributes on files outside their authority, leading to escalation to higher privileges. The flaw was reported by VulnCheck; no public exploit has been identified at time of analysis, and it is not listed in CISA KEV.

RemediationAI

Vendor-released patch: upgrade attr to version 2.6.0 or later, which corrects the symlink handling during directory traversal; the upstream fix commits are at https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=c440855d6b33446edf4b5eb1a2d892281f15a99b and .../commit/?id=49f79e947270f06940b9100fa638f85dddc4aa7f. On managed systems, apply the distribution's updated attr package (which may backport the fix to an earlier version string) rather than building from source. Until patched, avoid running getfattr/setfattr recursively as root or any privileged user over directory trees that unprivileged users can write to, and where such operations are unavoidable, restrict write/ownership of intermediate directories so attackers cannot insert symlink components; the trade-off is that recursive xattr management on shared or user-writable directories must be paused or sandboxed, which can disrupt backup and migration workflows that rely on these tools. Review the VulnCheck advisory (https://www.vulncheck.com/advisories/attr-symlink-traversal-privilege-escalation-via-getfattr-setfattr) for vendor guidance.

Affected VersionsENISA

acl 0 <2.6.0

Affected Packages

euvd acl fix: 2.6.0

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The attr package (CPE cpe:2.3:a:acl_project:acl) provides the userspace getfattr/setfattr tools for reading and setting Linux extended attributes (xattrs) on filesystem objects. The root cause is CWE-59 (Improper Link Resolution Before File Access, 'Link Following'): when these utilities recurse through a directory hierarchy, they resolve each pathname component without guarding against a component being replaced by a symlink mid-traversal, a classic TOCTOU/symlink-following weakness. Because the operation follows the symlink to its target, an attacker who controls any intermediate component can redirect the privileged tool to a file of their choosing rather than the intended path.

Know when Acl gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (VulnCheck) PRIMARY 8.4 HIGH
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
vuln.today AI 6.3 MEDIUM

Local, authenticated user (AV:L/PR:L); symlink-swap during privileged traversal implies a race window (AC:H); redirecting reads/writes yields high confidentiality and integrity impact, no availability loss.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE 7.4 HIGH
AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat 6.3 MEDIUM

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Local
Attack Complexity
Low
Attack Requirements
None
Privileges Required
Low
User Interaction
None
Vulnerable system: Confidentiality
High
Vulnerable system: Integrity
High
Vulnerable system: Availability
None
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
None

DescriptionCVE.org

attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path.

Executive ViewAI

Why It Matters

The attr package versions prior to 2.6.0 contain a privilege escalation vulnerability allowing local attackers to gain unauthorized access to system files and data (no public exploit identified at time of analysis). This affects Linux systems where attr utilities operate in administrative contexts, potentially compromising system integrity and data confidentiality. Organizations must upgrade to version 2.6.0 or later to mitigate this risk.

Business Impact: High
Compensating Controls

Apply vendor patch: attr 2.6.0 or later.

Threat Intelligence Overview

EPSS Score
0.1%
Top 96% exploitable
Prevalence
High
attr/getfattr/setfattr shipped by virtually all Linux distributions
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Small
Automatable
No
Human Impact
High
Technical Impact
Partial

Priority Score

42
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +42
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.

More in Acl

View all
CVE-2018-25320 CRITICAL POC
9.3 May 17

ACL Analytics versions 11.x through 13.0.0.579 contain an arbitrary code execution vulnerability that allows attackers t
CVE-2026-54369 HIGH
8.4 Jun 29

Local privilege escalation in the Linux acl utilities (libacl) before version 2.4.0 arises because the pathname-based fu
CVE-2026-54370 HIGH
7.2 Jun 29

Local privilege escalation in the Linux acl package (libacl/getfacl/setfacl/chacl) before version 2.4.0 lets an unprivil

Same weakness CWE-59 – Improper Link Resolution Before File Access

View all
CVE-2020-0787 HIGH POC
7.8
CVE-2015-1130 HIGH POC
7.8
CVE-2015-5287 HIGH POC
7.8
CVE-2026-41091 HIGH POC
7.8
CVE-2019-1069 HIGH POC
7.8
CVE-2026-81963 HIGH POC
7.8
CVE-2016-6664 HIGH POC
7.0
CVE-2025-60710 HIGH POC
7.8

Same technique Privilege Escalation

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2024-9474 MEDIUM POC
6.9
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected

References

Advisories & patches
PATCH https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=c440855d6b33446edf4b5eb1a2d892281f15a99b ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-54371 ADVISORY https://vuldb.com/vuln/374626 REF https://access.redhat.com/errata/RHSA-2026:34889 REF https://access.redhat.com/errata/RHSA-2026:56133 REF https://access.redhat.com/errata/RHSA-2026:59380 REF https://access.redhat.com/errata/RHSA-2026:60226 REF https://access.redhat.com/errata/RHSA-2026:61783 REF https://access.redhat.com/errata/RHSA-2026:63135 REF https://access.redhat.com/errata/RHSA-2026:63138 REF https://access.redhat.com/errata/RHSA-2026:66018 REF https://access.redhat.com/security/cve/CVE-2026-54371 REF https://bugzilla.redhat.com/show_bug.cgi?id=2490283 REF https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=49f79e947270f06940b9100fa638f85dddc4aa7f REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54371.json REF https://www.vulncheck.com/advisories/attr-symlink-traversal-privilege-escalation-via-getfattr-setfattr

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy