8.4
High
CVE-2026-54371 attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that…
Description
attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| acl 2.6 | earliest → < 2.6.0 | 2.6.0 |
| Red Hat Enterprise Linux 10 | Versions not published | |
| Red Hat Enterprise Linux 6 | Versions not published | |
| Red Hat Enterprise Linux 7 | Versions not published | |
| Red Hat Enterprise Linux 8 | Versions not published | |
| Red Hat Enterprise Linux 9 | Versions not published | |
| Red Hat Hardened Images 2.6 | earliest → < 2.6.0-9.1.hum1 | 2.6.0-9.1.hum1 |
| Red Hat OpenShift Container Platform 4 | Versions not published | |
| attr 2.6 | earliest → < 2.6.0 | 2.6.0 |
Show the 3 other branches Hide the 3 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Discovery 2 1788205779 | earliest → < 1788205779 | 1788205779 |
| Cert Manager support for Red Hat OpenShift release 1.19 1788348571 | earliest → < 1788348571 | 1788348571 |
| Red Hat Update Infrastructure 5 1788880581 | earliest → < 1788880581 | 1788880581 |
References
- cgit.git.savannah.nongnu.org cgit.git.savannah.nongnu.org
- cgit.git.savannah.nongnu.org cgit.git.savannah.nongnu.org
- www.vulncheck.com www.vulncheck.com
Timeline
- Published
- Last modified