Moderate Security Vulnerability in attr Package: Symlink Traversal Privilege Escalation
Summary
RLSA-2026:59380: Moderate: attr security update. Affects attr versions < 0:2.6.0-1.el10_2. Fixed in 0:2.6.0-1.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The attr package is essential for managing extended attributes in Linux systems, allowing users to store metadata such as capabilities for executables and access control lists. This functionality is crucial for enhancing security and managing permissions effectively. However, the package is vulnerable to a symlink traversal attack, which can lead to privilege escalation if exploited.
Vulnerability Detail
The vulnerability identified as CVE-2026-54371 in the attr package allows an attacker to exploit symlink traversal through the getfattr and setfattr commands. This can enable unauthorized access to sensitive files or system capabilities, potentially leading to privilege escalation. The vulnerability arises from improper validation of file paths, allowing attackers to manipulate symlinks to gain access to files outside the intended directory structure.
How To Fix
Minimum fixed version
0:2.6.0-1.el10_2
This is the first release that contains the fix.
sudo dnf update attrTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict the use of the getfattr and setfattr commands to trusted users only, thereby minimizing the risk of exploitation until the package is updated.
Conclusion
The attr package has a moderate security vulnerability that could lead to privilege escalation through symlink traversal. It is crucial to update to the patched version to protect your system. Users should also consider implementing temporary workarounds to limit exposure until the update can be applied.
See every vulnerability recorded for attr →
FAQ
The CVSS score for this vulnerability is 6.3, indicating a moderate level of risk.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If exploited, this vulnerability could allow an attacker to escalate privileges, potentially leading to unauthorized access to sensitive files and system capabilities.
Yes, the fixed version of the attr package is 0:2.6.0-1.el10_2. Updating to this version will resolve the vulnerability.
If immediate updates are not possible, restrict access to the getfattr and setfattr commands to trusted users to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for attr.
