This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-54371 →

DEBIAN-CVE-2026-54371

attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate pr...

Original description

The description as published by the source.

attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 attr

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 attr

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 attr

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.6.0-1"}]}]

References

advisory security-tracker.debian.org