CVE-2026-54370
acl < 2.4.0 TOCTOU Symlink Traversal via getfacl/setfacl/chacl
CVSS Score
6.3
EPSS Score
0.0%
EPSS Percentile
0th
acl before version 2.4.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link between an lstat() check and subsequent symlink-following operations such as stat(), chown(), chmod(), acl_get_file(), and acl_set_file(). Attackers who control a pathname component can redirect file access control list operations to arbitrary files when getfacl, setfacl, or chacl is invoked by a privileged process over an attacker-controlled path, resulting in local privilege escalation.
| CWE | CWE-367 |
| Vendor | acl project |
| Product | acl |
| Published | Jun 29, 2026 |
Stay Ahead of the Next One
Get instant alerts for acl project acl
Be the first to know when new medium vulnerabilities affecting acl project acl are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N Attack Vector
Local
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
Affected Versions
acl project / acl
0 < 2.4.0
References
cgit.git.savannah.nongnu.org: https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1 cgit.git.savannah.nongnu.org: https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5 vulncheck.com: https://www.vulncheck.com/advisories/acl-toctou-symlink-traversal-via-getfacl-setfacl-chacl
Credits
Andrew Tridgell Andreas Gruenbacher