CVE-2026-54371: Symlink Traversal in attr getfattr/setfattr Before 2.6.0

Technical summary

The vulnerability exists in how getfattr and setfattr handle pathname traversal during extended attribute operations. The flaw allows local privilege escalation via symlink substitution (CWE-59, Improper Link Resolution Before File Access). An attacker with local system access can craft a directory structure where they control one or more pathname components. By replacing a component with a symbolic link during hierarchy traversal, they redirect the utility's file operations to targets of their choosing. The impact is realized when a privileged user or process invokes getfattr or setfattr over an attacker-controlled path, allowing the attacker to read sensitive attributes from or write attributes to protected files.

Business impact

This vulnerability enables unprivileged local users to gain elevated privileges, potentially leading to unauthorized data access, system compromise, and lateral movement within an organization. The risk is particularly acute in multi-user systems, shared hosting environments, and container deployments where local access isolation is a security boundary. Affected organizations may experience unauthorized modification of system configuration, exposure of sensitive metadata, or full system compromise depending on what files and attributes an attacker targets.

Affected systems

The attr package (containing getfattr and setfattr) versions before 2.6.0 are vulnerable. Users should verify their current version and check vendor advisories for precise patch availability across distributions (Linux distributions typically package attr, so patch availability varies by distro and release cycle).

Exploitability

Exploitation requires local system access and does not require special privileges to initiate (though the impact is amplified if a privileged process invokes the vulnerable utilities over an attacker-controlled path). The attack is straightforward from a technical standpoint: replace a pathname component with a symlink and trigger the operation. No user interaction or network access is needed. The CVSS score of 7.1 reflects the local-only attack vector and the requirement for initial local presence, balanced against the high confidentiality and integrity impact.

Remediation

Upgrade the attr package to version 2.6.0 or later. Administrators should prioritize this patch for systems where unprivileged local users have shell access or can influence directory structures that privileged processes traverse. Interim mitigation includes restricting local shell access and auditing which processes run getfattr or setfattr with elevated privileges over user-writable paths.

Patch guidance

Apply patches from your distribution's package repository or from the upstream attr project. Verify that your system has upgraded to attr 2.6.0 or newer by running `getfattr --version` or `setfattr --version`. Test the patch in non-production environments first, particularly in systems where getfattr or setfattr are integrated into automation or privileged workflows. Consult your vendor's official security advisory for backport availability if you cannot immediately upgrade to the latest version.

Detection guidance

Monitor for suspicious symlink creation in directories where getfattr or setfattr operations are performed. Audit privilege escalation attempts and review logs for getfattr/setfattr invocations on non-standard paths or with unexpected privilege levels. File integrity monitoring tools may detect unexpected changes to protected files if an attacker successfully redirects an operation. Consider using AppArmor, SELinux, or similar mandatory access controls to restrict where these utilities can operate.

Why prioritize this

Although the CVSS score is 7.1 (HIGH), the attack requires local system access and the impact depends on the specific usage patterns and privilege model of your environment. Prioritize this patch for systems with multiple unprivileged users, shared hosting platforms, containerized environments, or any system where elevated-privilege processes rely on getfattr or setfattr. Lower priority for single-user or tightly controlled systems with minimal local access, but should not be deferred indefinitely.

Risk score, explained

The CVSS 3.1 score of 7.1 reflects a local-only attack vector (AV:L), no special access requirements beyond local presence (PR:L), straightforward exploitation (AC:L), no user interaction needed (UI:N), and scoped to the affected user's scope (S:U). The high impact is due to confidentiality (C:H) and integrity (I:H) damage potential—an attacker can read sensitive attributes or modify system metadata. Availability is not directly impacted (A:N). The score appropriately captures a privilege escalation risk in local multi-user scenarios while excluding scenarios requiring network access or prior privilege.

Frequently asked questions