Skip to content
OpenAdvisories
High USN-8691-1 1 CVE

attr vulnerability

Published Aug 31, 2026 · Updated Aug 31, 2026

Ecosystem: Ubuntu

Summary

It was discovered that attr incorrectly handled symbolic links while
traversing directory paths. A local attacker who controlled a pathname
component could possibly use this issue to redirect privileged attr
operations to arbitrary files and gain elevated privileges.

Fixed packages 7

ReleasePackageFixed in
Ubuntu · 22.04 LTS 22.04:LTS attr 1:2.5.1-1ubuntu0.1
Ubuntu · 24.04 LTS 24.04:LTS attr 1:2.5.2-1ubuntu0.1
Ubuntu · 26.04 LTS 26.04:LTS attr 1:2.5.2-4ubuntu0.1
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS attr 1:2.4.47-1ubuntu1+esm1
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS attr 1:2.4.47-2ubuntu0.16.04.1~esm1
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS attr 1:2.4.47-2ubuntu0.18.04.1~esm1
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS attr 1:2.4.48-5ubuntu0.1~esm1

Vulnerabilities 1

  • High 7.1
    CVE-2026-54371

    attr < 2.6.0 Symlink Traversal Privilege Escalation via getfattr/setfattr

    attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attacke…

    attr project attr acl attr Debian Ubuntu Azure Linux

References

  • report
    https://ubuntu.com/security/CVE-2026-54371