Loading story…
Multiple symlink traversal vulnerabilities in the Linux attr and acl packages can let a local attacker escalate privileges when privileged processes operate on attacker-controlled paths. The disclosed issues include CVE-2026-54371 in getfattr and setfattr, and CVE-2026-54369 in pathname-based libacl functions; an accompanying security notice also identifies CVE-2026-54370 affecting getfacl, setfacl, and chacl. In each case, an attacker can replace a pathname component with a symbolic link during directory traversal, redirecting file or ACL operations to unintended targets and enabling unauthorized changes to arbitrary files or directories.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
The disclosed flaws were fixed in acl version 2.4.0 and attr version 2.6.0. The fixes added symlink-safe libacl APIs and reworked affected utilities to use safer path resolution and directory file descriptor handling.
A security notice disclosed multiple symbolic-link handling vulnerabilities in the acl and attr packages that could enable local privilege escalation when privileged users invoke affected utilities or libacl functions on attacker-controlled paths. The issues were assigned CVE-2026-54369, CVE-2026-54370, and CVE-2026-54371.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
4 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourceseclists.org
Open sourceseclists.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple newly disclosed vulnerabilities exposed **arbitrary file write** paths through symlink handling and path validation failures in developer and server-side software. In **Crawl4AI** before `0.8.8`, `CVE-2026-56258` affects screenshot and PDF endpoints by combining weak `output_path` validation, symlink following, and a **TOCTOU** race, allowing unauthenticated remote attackers to write files outside the intended directory and potentially reach code execution. In **Cursor Desktop** before `3.0`, `CVE-2026-50549` lets a malicious agent escape the workspace sandbox by forcing path canonicalization to fail and then abusing an in-workspace symlink to write arbitrary files under the user’s privileges, including paths that could enable later unsandboxed execution. A related pattern also appeared in archive extraction and privileged upload handling. The **extract-zip** package is affected by `CVE-2026-56876`, which fails to validate symlink targets inside ZIP archives, enabling path traversal outside the extraction directory and possible arbitrary file read or write when processing untrusted archives. Separately, **pwnlift** disclosed `CVE-2026-56815` in a privileged upload handler that could be abused for arbitrary file write **as root** through direct symlink following and a TOCTOU race; an initial fix was bypassable before a follow-up patch was merged, while one downstream deployment mitigated exposure by removing the privileged `sudo` entry. Together, the disclosures highlight recurring risk from incomplete path canonicalization, unsafe symlink handling, and containment checks in file-write workflows.
Jul 2, 2026
Red Hat disclosed **CVE-2026-50526**, a moderate-severity flaw in **.NET** caused by improper link resolution before file access, tracked as **`CWE-59`**. The vulnerability allows an authorized local attacker to exploit link following behavior to tamper with files, potentially modifying application data or system files outside the intended target. Red Hat assigned the issue a **CVSS v3 score of 7.0**, while the NVD scored it **5.5**, reflecting different assessments of the flaw's impact. The weakness matches the broader **link following** class in which software accesses a file path without preventing resolution through symlinks, hard links, shortcuts, or similar mechanisms, creating opportunities for unauthorized read or write operations. Red Hat reported fixes across multiple **RHEL 8, 9, and 10** product lines, including specialized support channels such as **RHEL 10.0 EUS**, **RHEL 9.4 Update Services for SAP Solutions**, and **RHEL 9.6 EUS**, with remediation delivered through RHSA advisories published in July and August 2026.
Aug 24, 2026
The GNU C Library project disclosed **`CVE-2025-4802`**, a local privilege-escalation flaw affecting glibc versions **2.27 through 2.38**. The bug causes statically linked **setuid/setgid** ELF binaries that call `dlopen()`—directly or indirectly through functions such as `setlocale`, `getaddrinfo`, or other NSS-related paths—to incorrectly honor **`LD_LIBRARY_PATH`** in secure execution mode, allowing attacker-controlled libraries to be loaded and executed with elevated privileges. Upstream tracked the issue in advisory **`GLIBC-SA-2025-0002`**, describing it as locally exploitable and dependent on the presence of a privileged static binary that invokes dynamic loading. Technical analysis traced the flaw to a 2017 glibc change that removed trusted-path enforcement during runtime path initialization, while the fix moved secure-mode environment sanitization earlier in `_dl_non_dynamic_init()` so variables such as **`LD_LIBRARY_PATH`** are cleared before library search paths are built; the correction landed upstream in **glibc 2.39**. Public writeups and mailing-list discussion included proof-of-concept exploitation using malicious **NSS** modules to achieve code execution as **root** or with **SGID** privileges, but both the advisory and follow-on analysis said practical exposure appears limited because no default-distribution binaries meeting the exploit conditions had been identified, though custom privileged programs remain at risk.
Aug 20, 2026