CVE-2026-54369 acl < 2.4.0 Symlink Traversal Privilege Escalation via libacl Functions

Q: What is CVE-2026-54369?

CVE-2026-54369 is a high-severity path traversal vulnerability in acl, published on 29 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Q: Is CVE-2026-54369 being exploited?

There is no known exploitation of CVE-2026-54369 in the wild and no public exploit code.

High 8.4 Published 29 Jun 2026 Updated 14 Sep 2026

Local attackers can escalate privileges by exploiting symlink traversal in libacl functions to manipulate access control lists on arbitrary files.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2026-54369?

CVE-2026-54369 is a high-severity path traversal vulnerability in acl, published on 29 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.

Weakness: CWE-59

Which versions are affected by CVE-2026-54369?

Linux distribution packages (40)

`acl` Red Hat:enterprise_linux_eus:10.0	All versions	`0:2.4.0-0.el10_0.1`
`libacl` Red Hat:enterprise_linux_eus:10.0	All versions	`0:2.4.0-0.el10_0.1`
`libacl-debuginfo` Red Hat:enterprise_linux_eus:10.0	All versions	`0:2.4.0-0.el10_0.1`
`acl` Red Hat:rhel_aus:8.4::baseos	All versions	`0:2.4.0-0.el8_4.1`
`acl-debuginfo` Red Hat:rhel_aus:8.4::baseos	All versions	`0:2.4.0-0.el8_4.1`
`acl-debugsource` Red Hat:rhel_aus:8.4::baseos	All versions	`0:2.4.0-0.el8_4.1`
`libacl` Red Hat:rhel_aus:8.4::baseos	All versions	`0:2.4.0-0.el8_4.1`
`libacl-debuginfo` Red Hat:rhel_aus:8.4::baseos	All versions	`0:2.4.0-0.el8_4.1`
`libacl-devel` Red Hat:rhel_aus:8.4::baseos	All versions	`0:2.4.0-0.el8_4.1`
`acl` Red Hat:rhel_aus:8.6::baseos	All versions	`0:2.4.0-0.el8_6.1`
`acl-debuginfo` Red Hat:rhel_aus:8.6::baseos	All versions	`0:2.4.0-0.el8_6.1`
`acl-debugsource` Red Hat:rhel_aus:8.6::baseos	All versions	`0:2.4.0-0.el8_6.1`
`libacl` Red Hat:rhel_aus:8.6::baseos	All versions	`0:2.4.0-0.el8_6.1`
`libacl-debuginfo` Red Hat:rhel_aus:8.6::baseos	All versions	`0:2.4.0-0.el8_6.1`
`libacl-devel` Red Hat:rhel_aus:8.6::baseos	All versions	`0:2.4.0-0.el8_6.1`
`acl` Red Hat:rhel_e4s:8.8::baseos	All versions	`0:2.4.0-0.el8_8.1`
`acl-debuginfo` Red Hat:rhel_e4s:8.8::baseos	All versions	`0:2.4.0-0.el8_8.1`
`acl-debugsource` Red Hat:rhel_e4s:8.8::baseos	All versions	`0:2.4.0-0.el8_8.1`
`libacl` Red Hat:rhel_e4s:8.8::baseos	All versions	`0:2.4.0-0.el8_8.1`
`libacl-debuginfo` Red Hat:rhel_e4s:8.8::baseos	All versions	`0:2.4.0-0.el8_8.1`
`libacl-devel` Red Hat:rhel_e4s:8.8::baseos	All versions	`0:2.4.0-0.el8_8.1`
`acl-debuginfo` Red Hat:rhel_e4s:9.2::appstream	All versions	`0:2.4.0-0.el9_2.1`
`acl-debugsource` Red Hat:rhel_e4s:9.2::appstream	All versions	`0:2.4.0-0.el9_2.1`
`acl` Red Hat:rhel_e4s:9.2::baseos	All versions	`0:2.4.0-0.el9_2.1`
`acl-debuginfo` Red Hat:rhel_e4s:9.2::baseos	All versions	`0:2.4.0-0.el9_2.1`
`acl-debugsource` Red Hat:rhel_e4s:9.2::baseos	All versions	`0:2.4.0-0.el9_2.1`
`acl-debuginfo` Red Hat:rhel_e4s:9.4::appstream	All versions	`0:2.4.0-0.el9_4.1`
`acl-debugsource` Red Hat:rhel_e4s:9.4::appstream	All versions	`0:2.4.0-0.el9_4.1`
`acl` Red Hat:rhel_e4s:9.4::baseos	All versions	`0:2.4.0-0.el9_4.1`
`acl-debuginfo` Red Hat:rhel_e4s:9.4::baseos	All versions	`0:2.4.0-0.el9_4.1`
`acl-debugsource` Red Hat:rhel_e4s:9.4::baseos	All versions	`0:2.4.0-0.el9_4.1`
`acl-debuginfo` Red Hat:rhel_eus:9.6::appstream	All versions	`0:2.4.0-0.el9_6.1`
`acl-debugsource` Red Hat:rhel_eus:9.6::appstream	All versions	`0:2.4.0-0.el9_6.1`
`acl` Red Hat:rhel_eus:9.6::baseos	All versions	`0:2.4.0-0.el9_6.1`
`acl-debuginfo` Red Hat:rhel_eus:9.6::baseos	All versions	`0:2.4.0-0.el9_6.1`
`acl-debugsource` Red Hat:rhel_eus:9.6::baseos	All versions	`0:2.4.0-0.el9_6.1`
`acl` Red Hat:rhel_eus_long_life:8.4::baseos	All versions	`0:2.4.0-0.el8_4.1`
`acl-debuginfo` Red Hat:rhel_eus_long_life:8.4::baseos	All versions	`0:2.4.0-0.el8_4.1`
`acl-debugsource` Red Hat:rhel_eus_long_life:8.4::baseos	All versions	`0:2.4.0-0.el8_4.1`
`libacl` Red Hat:rhel_eus_long_life:8.4::baseos	All versions	`0:2.4.0-0.el8_4.1`

How do I fix CVE-2026-54369?

Upgrade to a fixed version.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2026-54369 being exploited?