CVE catalog

CVE-2026-54369

acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows lo

[CVE catalog]

Severity
High · CVSS 8.4CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Published
Source
[NVD] · [CVE record]
EPSS
0.15% · Oct 25, 2026

acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianaclsid2.4.0-1fixed
Debianaclforky2.4.0-1fixed
Debianacltrixie2.3.2-2vulnerable
Debianaclbookworm2.3.1-3vulnerable
CpeaclNot reportedNot reportedvulnerable
Suseacllinux enterprise server 16.02.4.0-160000.1.1fixed
Suseattrlinux enterprise server 16.02.6.0-160000.1.1fixed
Suseacllinux enterprise server for sap applications 16.02.4.0-160000.1.1fixed
Suseattrlinux enterprise server for sap applications 16.02.6.0-160000.1.1fixed
Suseacllinux enterprise server 16.02.4.0-160000.1.1fixed
Suseattrlinux enterprise server 16.02.6.0-160000.1.1fixed
Suseacllinux enterprise server for sap applications 16.02.4.0-160000.1.1fixed
Suseattrlinux enterprise server for sap applications 16.02.6.0-160000.1.1fixed
Suseacllinux micro 6.22.4.0-160000.1.1fixed
Suseattrlinux micro 6.22.6.0-160000.1.1fixed
Suseacllinux enterprise micro 5.32.4.0-150000.4.6.1fixed
Suseattrlinux enterprise micro 5.32.6.0-150000.4.3.1fixed
Suseacllinux enterprise micro 5.42.4.0-150000.4.6.1fixed
Suseattrlinux enterprise micro 5.42.6.0-150000.4.3.1fixed
Suseacllinux enterprise micro 5.52.4.0-150000.4.6.1fixed
Suseattrlinux enterprise micro 5.52.6.0-150000.4.3.1fixed
Suseacllinux enterprise module for basesystem 15 sp72.4.0-150000.4.6.1fixed
Suseattrlinux enterprise module for basesystem 15 sp72.6.0-150000.4.3.1fixed
Suseacllinux enterprise high performance computing 15 sp4-espos2.4.0-150000.4.6.1fixed
Suseattrlinux enterprise high performance computing 15 sp4-espos2.6.0-150000.4.3.1fixed
Suseacllinux enterprise high performance computing 15 sp4-ltss2.4.0-150000.4.6.1fixed
Suseattrlinux enterprise high performance computing 15 sp4-ltss2.6.0-150000.4.3.1fixed
Suseacllinux enterprise high performance computing 15 sp5-espos2.4.0-150000.4.6.1fixed
Suseattrlinux enterprise high performance computing 15 sp5-espos2.6.0-150000.4.3.1fixed
Suseacllinux enterprise high performance computing 15 sp5-ltss2.4.0-150000.4.6.1fixed
Suseattrlinux enterprise high performance computing 15 sp5-ltss2.6.0-150000.4.3.1fixed
Suseacllinux enterprise server 15 sp4-ltss2.4.0-150000.4.6.1fixed
Suseattrlinux enterprise server 15 sp4-ltss2.6.0-150000.4.3.1fixed
Suseacllinux enterprise server 15 sp5-ltss2.4.0-150000.4.6.1fixed
Suseattrlinux enterprise server 15 sp5-ltss2.6.0-150000.4.3.1fixed
Suseacllinux enterprise server 15 sp6-ltss2.4.0-150000.4.6.1fixed
Suseattrlinux enterprise server 15 sp6-ltss2.6.0-150000.4.3.1fixed
Suseacllinux enterprise server for sap applications 15 sp42.4.0-150000.4.6.1fixed
Suseattrlinux enterprise server for sap applications 15 sp42.6.0-150000.4.3.1fixed
Suseacllinux enterprise server for sap applications 15 sp52.4.0-150000.4.6.1fixed
Suseattrlinux enterprise server for sap applications 15 sp52.6.0-150000.4.3.1fixed
Suseacllinux enterprise server for sap applications 15 sp62.4.0-150000.4.6.1fixed
Suseattrlinux enterprise server for sap applications 15 sp62.6.0-150000.4.3.1fixed
Opensuseaclleap 16.02.4.0-160000.1.1fixed
Opensuseattrleap 16.02.6.0-160000.1.1fixed
Opensuseacltumbleweed2.4.0-1.1fixed
Ubuntuacl14.042.2.52-1vulnerable
Ubuntuacl16.042.2.52-2vulnerable
Ubuntuacl16.042.2.52-3vulnerable
Ubuntuacl18.042.2.52-3build1vulnerable
Ubuntuacl20.042.2.53-4vulnerable
Ubuntuacl20.042.2.53-5vulnerable
Ubuntuacl20.042.2.53-5ubuntu1vulnerable
Ubuntuacl20.042.2.53-6vulnerable
Ubuntuacl22.042.2.53-10ubuntu2vulnerable
Ubuntuacl22.042.3.1-1vulnerable
Ubuntuacl24.042.3.1-3vulnerable
Ubuntuacl24.042.3.1-4ubuntu1vulnerable
Ubuntuacl24.042.3.2-1vulnerable
Ubuntuacl24.042.3.2-1build1vulnerable
Ubuntuacl24.042.3.2-1build1.1vulnerable
Ubuntuacl25.102.3.2-2vulnerable
Ubuntuacl26.042.3.2-2vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianaclsourcesid2.4.0-1not yet assignedNot reported[1141110]
Debianaclsourceforky2.4.0-1not yet assignedNot reported[1141110]
Debianaclsourcetrixie(unfixed)not yet assignedNot reported[1141110]
Debianaclsourcebookworm(unfixed)not yet assignedNot reported[1141110]
Suseaclrpmlinux enterprise server 16.02.4.0-160000.1.1Not reportedSUSE-SU-2026:23726-1Not reported
Suseattrrpmlinux enterprise server 16.02.6.0-160000.1.1Not reportedSUSE-SU-2026:23726-1Not reported
Suseaclrpmlinux enterprise server for sap applications 16.02.4.0-160000.1.1Not reportedSUSE-SU-2026:23726-1Not reported
Suseattrrpmlinux enterprise server for sap applications 16.02.6.0-160000.1.1Not reportedSUSE-SU-2026:23726-1Not reported
Suseaclrpmlinux enterprise server 16.02.4.0-160000.1.1Not reportedSUSE-SU-2026:23705-1Not reported
Suseattrrpmlinux enterprise server 16.02.6.0-160000.1.1Not reportedSUSE-SU-2026:23705-1Not reported
Suseaclrpmlinux enterprise server for sap applications 16.02.4.0-160000.1.1Not reportedSUSE-SU-2026:23705-1Not reported
Suseattrrpmlinux enterprise server for sap applications 16.02.6.0-160000.1.1Not reportedSUSE-SU-2026:23705-1Not reported
Suseaclrpmlinux micro 6.22.4.0-160000.1.1Not reportedSUSE-SU-2026:23670-1Not reported
Suseattrrpmlinux micro 6.22.6.0-160000.1.1Not reportedSUSE-SU-2026:23670-1Not reported
Suseaclrpmlinux enterprise micro 5.32.4.0-150000.4.6.1Not reportedSUSE-SU-2026:4176-1Not reported
Suseattrrpmlinux enterprise micro 5.32.6.0-150000.4.3.1Not reportedSUSE-SU-2026:4176-1Not reported
Suseaclrpmlinux enterprise micro 5.42.4.0-150000.4.6.1Not reportedSUSE-SU-2026:4176-1Not reported
Suseattrrpmlinux enterprise micro 5.42.6.0-150000.4.3.1Not reportedSUSE-SU-2026:4176-1Not reported
Suseaclrpmlinux enterprise micro 5.52.4.0-150000.4.6.1Not reportedSUSE-SU-2026:4176-1Not reported
Suseattrrpmlinux enterprise micro 5.52.6.0-150000.4.3.1Not reportedSUSE-SU-2026:4176-1Not reported
Suseaclrpmlinux enterprise module for basesystem 15 sp72.4.0-150000.4.6.1Not reportedSUSE-SU-2026:4176-1Not reported
Suseattrrpmlinux enterprise module for basesystem 15 sp72.6.0-150000.4.3.1Not reportedSUSE-SU-2026:4176-1Not reported
Suseaclrpmlinux enterprise high performance computing 15 sp4-espos2.4.0-150000.4.6.1Not reportedSUSE-SU-2026:4176-1Not reported
Suseattrrpmlinux enterprise high performance computing 15 sp4-espos2.6.0-150000.4.3.1Not reportedSUSE-SU-2026:4176-1Not reported
Suseaclrpmlinux enterprise high performance computing 15 sp4-ltss2.4.0-150000.4.6.1Not reportedSUSE-SU-2026:4176-1Not reported
Suseattrrpmlinux enterprise high performance computing 15 sp4-ltss2.6.0-150000.4.3.1Not reportedSUSE-SU-2026:4176-1Not reported
Suseaclrpmlinux enterprise high performance computing 15 sp5-espos2.4.0-150000.4.6.1Not reportedSUSE-SU-2026:4176-1Not reported
Suseattrrpmlinux enterprise high performance computing 15 sp5-espos2.6.0-150000.4.3.1Not reportedSUSE-SU-2026:4176-1Not reported
Suseaclrpmlinux enterprise high performance computing 15 sp5-ltss2.4.0-150000.4.6.1Not reportedSUSE-SU-2026:4176-1Not reported
Suseattrrpmlinux enterprise high performance computing 15 sp5-ltss2.6.0-150000.4.3.1Not reportedSUSE-SU-2026:4176-1Not reported
Suseaclrpmlinux enterprise server 15 sp4-ltss2.4.0-150000.4.6.1Not reportedSUSE-SU-2026:4176-1Not reported
Suseattrrpmlinux enterprise server 15 sp4-ltss2.6.0-150000.4.3.1Not reportedSUSE-SU-2026:4176-1Not reported
Suseaclrpmlinux enterprise server 15 sp5-ltss2.4.0-150000.4.6.1Not reportedSUSE-SU-2026:4176-1Not reported
Suseattrrpmlinux enterprise server 15 sp5-ltss2.6.0-150000.4.3.1Not reportedSUSE-SU-2026:4176-1Not reported
Suseaclrpmlinux enterprise server 15 sp6-ltss2.4.0-150000.4.6.1Not reportedSUSE-SU-2026:4176-1Not reported
Suseattrrpmlinux enterprise server 15 sp6-ltss2.6.0-150000.4.3.1Not reportedSUSE-SU-2026:4176-1Not reported
Suseaclrpmlinux enterprise server for sap applications 15 sp42.4.0-150000.4.6.1Not reportedSUSE-SU-2026:4176-1Not reported
Suseattrrpmlinux enterprise server for sap applications 15 sp42.6.0-150000.4.3.1Not reportedSUSE-SU-2026:4176-1Not reported
Suseaclrpmlinux enterprise server for sap applications 15 sp52.4.0-150000.4.6.1Not reportedSUSE-SU-2026:4176-1Not reported
Suseattrrpmlinux enterprise server for sap applications 15 sp52.6.0-150000.4.3.1Not reportedSUSE-SU-2026:4176-1Not reported
Suseaclrpmlinux enterprise server for sap applications 15 sp62.4.0-150000.4.6.1Not reportedSUSE-SU-2026:4176-1Not reported
Suseattrrpmlinux enterprise server for sap applications 15 sp62.6.0-150000.4.3.1Not reportedSUSE-SU-2026:4176-1Not reported
Opensuseaclrpmleap 16.02.4.0-160000.1.1Not reportedOPENSUSE-SU-2026:21832-1Not reported
Opensuseattrrpmleap 16.02.6.0-160000.1.1Not reportedOPENSUSE-SU-2026:21832-1Not reported
Opensuseaclrpmtumbleweed2.4.0-1.1Not reportedOPENSUSE-SU-2026:11312-1Not reported

[Debian bug #1141110]

Notes

[trixie] acl: Will be fixed first in unstable, then point release update; not to be backported by individual patches [bookworm] acl: Minor issue; libacl acl_*_file() follow symlinks; fix adds new acl_*_at() ABI, not individually backportable

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [acl]Affected
    Details (2)

    • 2.3.1-3 · amd64 · bookworm

      Affected

      nvd · acl · debian · bookworm; nvd · acl · debian · 12

    • 2.3.1-3 · arm64 · bookworm

      Affected

      nvd · acl · debian · bookworm; nvd · acl · debian · 12

  • [libacl1]Affected

    Source package: [acl]

    Details (2)

    • 2.3.1-3 · amd64 · bookworm

      Affected

      nvd · acl · debian · bookworm; nvd · acl · debian · 12

    • 2.3.1-3 · arm64 · bookworm

      Affected

      nvd · acl · debian · bookworm; nvd · acl · debian · 12

  • [libacl1-dev]Affected

    Source package: [acl]

    Details (2)

    • 2.3.1-3 · amd64 · bookworm

      Affected

      nvd · acl · debian · bookworm; nvd · acl · debian · 12

    • 2.3.1-3 · arm64 · bookworm

      Affected

      nvd · acl · debian · bookworm; nvd · acl · debian · 12

[Debian 13 (Trixie)]

  • [acl]Affected

    Source package: [acl]

    Details (2)

    • 2.3.2-2+b1 · amd64 · trixie

      Affected

      nvd · acl · debian · 13

    • 2.3.2-2+b1 · arm64 · trixie

      Affected

      nvd · acl · debian · 13

  • [libacl1]Affected

    Source package: [acl]

    Details (2)

    • 2.3.2-2+b1 · amd64 · trixie

      Affected

      nvd · acl · debian · 13

    • 2.3.2-2+b1 · arm64 · trixie

      Affected

      nvd · acl · debian · 13

  • [libacl1-dev]Affected

    Source package: [acl]

    Details (2)

    • 2.3.2-2+b1 · amd64 · trixie

      Affected

      nvd · acl · debian · 13

    • 2.3.2-2+b1 · arm64 · trixie

      Affected

      nvd · acl · debian · 13

[openSUSE Tumbleweed]

  • [libacl1]Unknown

    Source package: [acl]

    Details (1)

    • 2.4.0-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 2.4.0-1.1

      Version impact unknown

      nvd · acl · opensuse · tumbleweed

  • [libacl1-32bit]Unknown

    Source package: [acl]

    Details (1)

    • 2.4.0-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 2.4.0-1.1

      Version impact unknown

      nvd · acl · opensuse · tumbleweed

  • [libacl-devel]Unknown

    Source package: [acl]

    Details (1)

    • 2.4.0-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 2.4.0-1.1

      Version impact unknown

      nvd · acl · opensuse · tumbleweed

  • [libacl-devel-32bit]Unknown

    Source package: [acl]

    Details (1)

    • 2.4.0-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 2.4.0-1.1

      Version impact unknown

      nvd · acl · opensuse · tumbleweed

  • [acl]Fixed

    Source package: [acl]

    Details (1)

    • 2.4.0-1.2 · x86_64 · tumbleweed

      Fixed · Fixed: 2.4.0-1.1

      nvd · acl · opensuse · tumbleweed

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]