CVE-2026-54371

HIGH 7.1

attr < 2.6.0 Symlink Traversal Privilege Escalation via getfattr/setfattr

CVSS Score

7.1

EPSS Score

0.1%

EPSS Percentile

3th

attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path.

CWE	CWE-59
Vendor	attr project
Product	attr
Published	Jun 29, 2026
Last Updated	Aug 7, 2026

Stay Ahead of the Next One

Get instant alerts for attr project attr

Be the first to know when new high vulnerabilities affecting attr project attr are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Affected Versions

attr project / attr

0 < 2.6.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

cgit.git.savannah.nongnu.org: https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=c440855d6b33446edf4b5eb1a2d892281f15a99b cgit.git.savannah.nongnu.org: https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=49f79e947270f06940b9100fa638f85dddc4aa7f vulncheck.com: https://www.vulncheck.com/advisories/attr-symlink-traversal-privilege-escalation-via-getfattr-setfattr access.redhat.com: https://access.redhat.com/security/cve/CVE-2026-54371 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2490283 security.access.redhat.com: https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54371.json access.redhat.com: https://access.redhat.com/errata/RHSA-2026:34889

Credits

Andrew Tridgell Andreas Gruenbacher