CVE-2026-54371: attr < 2.6.0 Symlink Traversal Privilege Escalation via getfattr/setfattr
attr < 2.6.0 Symlink Traversal Privilege Escalation via getfattr/setfattr
Other sources
attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path.
— NVD
attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr utility that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr is invoked by a privileged process over an attacker-controlled path.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.4.0-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.6.0-1 - Upgrade
Upgrade
attrto a version that resolves this vulnerability.Fixed in 2.6.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-54371?
CVE-2026-54371 has a severity rating of 7.1, classified as high.
What does CVE-2026-54371 affect?
CVE-2026-54371 affects the attr utility version prior to 2.6.0.
How do I fix CVE-2026-54371?
To fix CVE-2026-54371, update the attr utility to version 2.6.0 or later.
What type of vulnerability is CVE-2026-54371?
CVE-2026-54371 is a symlink traversal privilege escalation vulnerability.
Who can exploit CVE-2026-54371?
CVE-2026-54371 can be exploited by local attackers who have control over a pathname component.