Symlink Traversal Vulnerability in ACL Before Version 2.4.0

CVE-2026-54369

What is CVE-2026-54369?

The ACL library, prior to version 2.4.0, is susceptible to a symlink traversal vulnerability. This flaw involves the libacl pathname-based functions, which can be exploited by local attackers. By substituting any component of a pathname with a symbolic link, attackers can gain the ability to escalate their privileges. This compromises the integrity of access control lists, allowing unauthorized read or write operations directed at arbitrary files or directories. Particularly, if an attacker has control over a pathname processed by a privileged caller, they can exploit this vulnerability to manipulate ACLs and elevate their local privileges.

References