CVE-2026-54369

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-54369
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54369.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-54369
Downstream
ALSA (3)
AZL (1)
CLSA (5)
DEBIAN (1)
ECHO (1)
MGASA (1)
OESA (1)
openSUSE (2)
RHSA (11)
RLSA (3)
ROOT (3)
SUSE (4)
UBUNTU (1)
Related
ALSA (3)
openSUSE (2)
SUSE (4)
Published
2026-06-29T12:37:21Z
Modified
2026-10-31T10:30:56Z
Severity
  • 8.4 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
acl < 2.4.0 Symlink Traversal Privilege Escalation via libacl Functions
Details

acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-59"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54369.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "fixed": "2.4.0"
                        }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                }
            ]
        },
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "fixed": "2.4.0"
                        }
                    ],
                    "source": "CPE_FIELD",
                    "strategy": "CPEApplicability"
                }
            ]
        },
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "fixed": "2.4.0"
                        }
                    ],
                    "source": "DESCRIPTION"
                }
            ]
        }
    ]
}
References

Affected packages

Git / cgit.git.savannah.nongnu.org/cgit/acl.git

Affected ranges

Type
GIT
Repo
https://cgit.git.savannah.nongnu.org/cgit/acl.git
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
3589787cd589b34bdd9265936e17190b6d3f17d1
Fixed
24a227d0ab8576612194f8a56c2314389adc74a5
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "fixed": "3589787cd589b34bdd9265936e17190b6d3f17d1"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "24a227d0ab8576612194f8a56c2314389adc74a5"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54369.json"