Skip to main content

libacl (acl) EUVDEUVD-2026-40085

| CVE-2026-54369 HIGH
Improper Link Resolution Before File Access (CWE-59)
2026-06-29 VulnCheck GHSA-53ch-pxc8-6g72
Privilege Escalation Acl Acl Project
8.4
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
8.4 HIGH
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.1 HIGH

Local privesc primitive requiring an unprivileged foothold (PR:L), low complexity, no user interaction; high confidentiality and integrity impact via redirected ACL writes, with no availability impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE
7.4 HIGH
AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat
7.1 HIGH
qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

1
Analysis Generated
Jun 29, 2026 - 14:21 vuln.today

DescriptionCVE.org

acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.

AnalysisAI

Local privilege escalation in the Linux acl utilities (libacl) before version 2.4.0 arises because the pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() follow symbolic links during ACL read/write operations. An attacker who controls any component of a pathname processed by a privileged caller can substitute a symlink to redirect ACL operations to arbitrary files, manipulating access control lists outside their authority. No public exploit identified at time of analysis, and the issue is not in CISA KEV; risk is gated on a privileged process operating on attacker-influenced paths.

Technical ContextAI

libacl is the userspace library (shipped in the acl package on virtually every Linux distribution) that implements POSIX.1e access control lists via tools like getfacl/setfacl and is linked by many privileged daemons, backup utilities, and installers. The affected functions resolve a caller-supplied pathname and operate on whatever the final path component points to. The root cause is CWE-59 (Improper Link Resolution Before File Access, i.e. link following): these APIs do not use O_NOFOLLOW-style safe resolution or fd-based *at() semantics, so a symlink planted at any path component is dereferenced. The CPE cpe:2.3:a:acl_project:acl:*:*:*:*:*:*:*:* confirms the upstream nongnu/savannah 'acl' project itself is the affected component, fixed at 2.4.0.

RemediationAI

Vendor-released patch: upgrade libacl/acl to version 2.4.0 or later, or to your distribution's backported package that incorporates commits 3589787cd589b34bdd9265936e17190b6d3f17d1 and 24a227d0ab8576612194f8a56c2314389adc74a5 (https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1), as described in the VulnCheck advisory (https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions). Until packages are updated, reduce exposure by auditing privileged processes that invoke setfacl/getfacl or libacl on paths inside attacker-writable directories and avoid running such operations against world-writable or untrusted-owned locations; where feasible, have privileged scripts resolve and validate the real path (or operate on a trusted fixed directory) before applying ACLs, and restrict write access to intermediate directories used by root-run jobs - noting these controls add operational friction and do not fully replace the library fix.

More in Acl

View all
CVE-2018-25320 CRITICAL POC
9.3 May 17

ACL Analytics versions 11.x through 13.0.0.579 contain an arbitrary code execution vulnerability that allows attackers t
CVE-2026-54371 HIGH
8.4 Jun 29

Local privilege escalation in the attr package's getfattr and setfattr utilities (versions before 2.6.0) allows an attac
CVE-2026-54370 HIGH
7.2 Jun 29

Local privilege escalation in the Linux acl package (libacl/getfacl/setfacl/chacl) before version 2.4.0 lets an unprivil

Same weakness CWE-59 – Improper Link Resolution Before File Access

View all
CVE-2020-0787 HIGH POC
7.8
CVE-2015-1130 HIGH POC
7.8
CVE-2015-5287 HIGH POC
7.8
CVE-2026-41091 HIGH POC
7.8
CVE-2019-1069 HIGH POC
7.8
CVE-2026-81963 HIGH POC
7.8
CVE-2016-6664 HIGH POC
7.0
CVE-2025-60710 HIGH POC
7.8

Same technique Privilege Escalation

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2024-9474 MEDIUM POC
6.9
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Liberty Linux 10 Fixed
SUSE Liberty Linux 8 Fixed
SUSE Liberty Linux 9 Fixed
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected

Share

EUVD-2026-40085 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy