AZL-91397
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-91397.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-91397
- Upstream
- Published
- 2026-06-29T14:16:57Z
- Modified
- 2026-08-30T05:26:50Z
- Summary
- CVE-2026-54369 affecting package acl for versions less than 2.4.0-1
- Details
-
acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions aclgetfile(), aclsetfile(), aclextendedfile(), and acldeletedef_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.
- References