Symlink Traversal in attr Before 2.6.0

Executive Summary

CVE-2026-54371 is a symlink traversal vulnerability in the attr package before version 2.6.0, specifically affecting the getfattr and setfattr utilities.

This flaw allows local attackers who control a pathname component to replace it with a symbolic link, redirecting file operations to arbitrary files.

When these utilities are run by a privileged process on an attacker-controlled path, this can lead to local privilege escalation.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow a local attacker to escalate their privileges on the affected system.

By substituting a symbolic link in a pathname component, an attacker can redirect getfattr and setfattr operations to arbitrary files.

If these utilities are executed by a privileged process, the attacker can gain higher-level access than intended, potentially compromising system security.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the getfattr and setfattr utilities in the attr package before version 2.6.0, which are local tools used to get and set extended attributes on files. Detection involves checking the installed version of the attr package to see if it is older than 2.6.0.

You can detect if your system is vulnerable by running a command to check the version of attr installed, for example:

• attr --version

If the version is before 2.6.0, your system is vulnerable. Additionally, you can audit usage of getfattr and setfattr commands, especially when run by privileged users, to identify if they are invoked on attacker-controlled paths.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade the attr package to version 2.6.0 or later, where this symlink traversal vulnerability has been fixed.

Until the upgrade can be applied, avoid running getfattr or setfattr utilities on untrusted or attacker-controlled paths, especially with elevated privileges.

Review and restrict local user permissions to prevent attackers from controlling pathname components used by privileged processes invoking these utilities.

Useful 0 Not Useful 0