EUVD-2026-40087
GHSA-hh95-r7mj-c9j5
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local, authenticated user (AV:L/PR:L); symlink-swap during privileged traversal implies a race window (AC:H); redirecting reads/writes yields high confidentiality and integrity impact, no availability loss.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
1DescriptionCVE.org
attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path.
AnalysisAI
Local privilege escalation in the attr package's getfattr and setfattr utilities (versions before 2.6.0) allows an attacker who controls a pathname component to swap it for a symbolic link during directory hierarchy traversal, redirecting attribute operations to arbitrary files. When these utilities are invoked by a privileged process over an attacker-influenced path, the attacker can read or write extended attributes on files outside their authority, leading to escalation to higher privileges. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated local user (PR:L) who controls at least one intermediate pathname component of a path that a privileged process traverses using getfattr or setfattr - for example a user-writable subdirectory inside a tree that a root-owned script processes recursively. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 4.0 base score is 8.4 (High) with vector AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N - local vector, low complexity, low privileges required, no user interaction, with high confidentiality and integrity impact but no availability impact, consistent with a privilege-escalation primitive rather than remote compromise. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A low-privileged local user identifies a privileged process - such as a root-run backup, restore, or attribute-migration script - that invokes getfattr or setfattr recursively over a directory the user can write to. The user replaces an intermediate pathname component with a symbolic link pointing to a sensitive file (or to a path where setting attributes grants escalated access), so when the privileged tool traverses the path it follows the symlink and operates on the attacker-chosen target, yielding privilege escalation. … |
| Remediation | Vendor-released patch: upgrade attr to version 2.6.0 or later, which corrects the symlink handling during directory traversal; the upstream fix commits are at https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=c440855d6b33446edf4b5eb1a2d892281f15a99b and .../commit/?id=49f79e947270f06940b9100fa638f85dddc4aa7f. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all systems running the attr package and identify current versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Local privilege escalation in the Linux acl utilities (libacl) before version 2.4.0 arises because the pathname-based fu
Local privilege escalation in the Linux acl package (libacl/getfacl/setfacl/chacl) before version 2.4.0 lets an unprivil
Same weakness CWE-59 – Improper Link Resolution Before File Access
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today