PT-2026-53273 · Acl · Acl

Andreas Gruenbacher + 1 · Published 2026-06-29 · Updated 2026-06-29 · CVE-2026-54370

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions acl versions prior to 2.4.0

Description A time-of-check to time-of-use (TOCTOU) race condition occurs when a local attacker replaces a pathname component with a symbolic link between an lstat() check and subsequent symlink-following operations. These operations include stat(), chown(), chmod(), acl get file(), and acl set file(). If a privileged process invokes getfacl, setfacl, or chacl over a path controlled by the attacker, file access control list operations can be redirected to arbitrary files, leading to local privilege escalation.

Recommendations Update to version 2.4.0 or later.

Fix

Time Of Check To Time Of Use

Weakness Enumeration

CWE-367

Related Identifiers

CVE-2026-54370

Affected Products

Acl

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-54370 · Security Note
• https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1 · Patch
• https://vulncheck.com/advisories/acl-toctou-symlink-traversal-via-getfacl-setfacl-chacl · Note
• https://twitter.com/VulmonFeeds/status/2071617947202728107 · Twitter Post
• https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5 · Note