acl project vulnerabilities

Products

• acl 2

Latest acl project CVEs

Newest publication first

1. CVE-2026-54370 acl < 2.4.0 TOCTOU Symlink Traversal via getfacl/setfacl/chacl

   Published 2026-06-29

   High·CVSS 7.2 EPSS 0.09%

   acl before version 2.4.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link between an lstat() check and subsequent symlink-following operations su...

2. CVE-2026-54369 acl < 2.4.0 Symlink Traversal Privilege Escalation via libacl Functions

   Published 2026-06-29

   High·CVSS 8.4 EPSS 0.15%

   acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.