{"id":"UBUNTU-CVE-2026-54369","details":"acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.","modified":"2026-07-01T21:27:56Z","published":"2026-06-29T14:16:00Z","upstream":["CVE-2026-54369"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-54369"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2026-54369"},{"type":"REPORT","url":"https://www.openwall.com/lists/oss-security/2026/06/29/1"},{"type":"REPORT","url":"https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5"},{"type":"REPORT","url":"https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1"},{"type":"REPORT","url":"https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-54369"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2490277"},{"type":"REPORT","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json"}],"affected":[{"package":{"name":"acl","ecosystem":"Ubuntu:14.04:LTS","purl":"pkg:deb/ubuntu/acl?arch=source&distro=trusty"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.52-1"],"ecosystem_specific":{"binaries":[{"binary_name":"acl","binary_version":"2.2.52-1"},{"binary_name":"libacl1","binary_version":"2.2.52-1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54369.json"}},{"package":{"name":"acl","ecosystem":"Ubuntu:16.04:LTS","purl":"pkg:deb/ubuntu/acl?arch=source&distro=xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.52-2","2.2.52-3"],"ecosystem_specific":{"binaries":[{"binary_version":"2.2.52-3","binary_name":"acl"},{"binary_name":"libacl1","binary_version":"2.2.52-3"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54369.json"}},{"package":{"name":"acl","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/acl?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.52-3build1"],"ecosystem_specific":{"binaries":[{"binary_name":"acl","binary_version":"2.2.52-3build1"},{"binary_version":"2.2.52-3build1","binary_name":"libacl1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54369.json"}},{"package":{"name":"acl","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/acl?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.53-4","2.2.53-5","2.2.53-5ubuntu1","2.2.53-6"],"ecosystem_specific":{"binaries":[{"binary_name":"acl","binary_version":"2.2.53-6"},{"binary_name":"libacl1","binary_version":"2.2.53-6"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54369.json"}},{"package":{"name":"acl","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/acl?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.53-10ubuntu2","2.3.1-1"],"ecosystem_specific":{"binaries":[{"binary_version":"2.3.1-1","binary_name":"acl"},{"binary_version":"2.3.1-1","binary_name":"libacl1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54369.json"}},{"package":{"name":"acl","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/acl?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.1-3","2.3.1-4ubuntu1","2.3.2-1","2.3.2-1build1","2.3.2-1build1.1"],"ecosystem_specific":{"binaries":[{"binary_name":"acl","binary_version":"2.3.2-1build1.1"},{"binary_name":"libacl1","binary_version":"2.3.2-1build1.1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54369.json"}},{"package":{"name":"acl","ecosystem":"Ubuntu:25.10","purl":"pkg:deb/ubuntu/acl?arch=source&distro=questing"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.2-2"],"ecosystem_specific":{"binaries":[{"binary_name":"acl","binary_version":"2.3.2-2"},{"binary_name":"libacl1","binary_version":"2.3.2-2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54369.json"}},{"package":{"name":"acl","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/acl?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.2-2"],"ecosystem_specific":{"binaries":[{"binary_name":"acl","binary_version":"2.3.2-2"},{"binary_version":"2.3.2-2","binary_name":"libacl1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54369.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"},{"type":"Ubuntu","score":"medium"}]}