Vulnerability · Published Jun 29, 2026 · Assigned by VulnCheck
CVE-2026-54371attr < 2.6.0 Symlink Traversal Privilege Escalation via getfattr/setfattr
High 7.1
In plain English
A high-severity security flaw in attr from attr project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | attr | 2.6.0-1.el10_2 | ALSA-2026:59380 |
| AlmaLinux:8 | attr | 2.6.0-1.el8_10 | ALSA-2026:56133 |
| AlmaLinux:9 | attr | 2.6.0-1.el9_8 | ALSA-2026:60226 |
| AlmaLinux:10 | libattr | 2.6.0-1.el10_2 | ALSA-2026:59380 |
| AlmaLinux:8 | libattr | 2.6.0-1.el8_10 | ALSA-2026:56133 |
| AlmaLinux:9 | libattr | 2.6.0-1.el9_8 | ALSA-2026:60226 |
| AlmaLinux:10 | libattr-devel | 2.6.0-1.el10_2 | ALSA-2026:59380 |
| AlmaLinux:8 | libattr-devel | 2.6.0-1.el8_10 | ALSA-2026:56133 |
| AlmaLinux:9 | libattr-devel | 2.6.0-1.el9_8 | ALSA-2026:60226 |
| Debian:12 | attr | no fix listed | DEBIAN-CVE-2026-54371 |
| Debian:13 | attr | no fix listed | DEBIAN-CVE-2026-54371 |
| Debian:14 | attr | 1:2.6.0-1 | DEBIAN-CVE-2026-54371 |
| Rocky Linux:10 | attr | 0:2.6.0-1.el10_2 | RLSA-2026:59380 |
| Rocky Linux:8 | attr | 0:2.6.0-1.el8_10 | RLSA-2026:56133 |
| Rocky Linux:9 | attr | 0:2.6.0-1.el9_8 | RLSA-2026:60226 |
| Ubuntu:22.04:LTS | attr | 1:2.5.1-1ubuntu0.1 | UBUNTU-CVE-2026-54371 |
| Ubuntu:22.04:LTS | attr | 1:2.5.1-1ubuntu0.1 | USN-8691-1 |
| Ubuntu:24.04:LTS | attr | 1:2.5.2-1ubuntu0.1 | USN-8691-1 |
| Ubuntu:24.04:LTS | attr | 1:2.5.2-1ubuntu0.1 | UBUNTU-CVE-2026-54371 |
| Ubuntu:25.10 | attr | no fix listed | UBUNTU-CVE-2026-54371 |
| Ubuntu:26.04:LTS | attr | 1:2.5.2-4ubuntu0.1 | USN-8691-1 |
| Ubuntu:26.04:LTS | attr | 1:2.5.2-4ubuntu0.1 | UBUNTU-CVE-2026-54371 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| attr project | attr | 0 – before 2.6.0 |
Weakness: CWE-59 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
References
- https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=c440855d6b33446edf4b5eb1a2d892281f15a99b patch
- https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=49f79e947270f06940b9100fa638f85dddc4aa7f issue-tracking
- https://www.vulncheck.com/advisories/attr-symlink-traversal-privilege-escalation-via-getfattr-setfattr third-party-advisory
- https://access.redhat.com/security/cve/CVE-2026-54371 vdb-entry, x_refsource_REDHAT
- RHBZ#2490283 issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54371.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:59380 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:60226 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:56133 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:63135 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:63138 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:61783 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:34889 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:66018 vendor-advisory, x_refsource_REDHAT