acl: Symlink traversal privilege escalation via libacl functions

A flaw was found in the acl package, specifically within its libacl pathname-based functions. A local attacker could exploit this vulnerability by using a symbolic link to replace a pathname component. This could allow the attacker to redirect access control list ACL read or write operations to...

CVE-2026-54369

acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions aclgetfile, aclsetfile, aclextendedfile, and acldeletedeffile that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who contr...

F5 Networks BIG-IP : libarchive vulnerability (K000140961)

The version of F5 Networks BIG-IP installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the K000140961 advisory. An improper link resolution flaw while extracting an archive can lead to changing the access control list ACL of the...

CVE-2023-1250

OTRS/OTRS Community Edition vulnerable to improper input validation in ACL modules, enabling local code execution via manipulated comments and ACL-names. Affected: OTRS 7.0.x before 7.0.42, 8.0.x before 8.0.31; CE 6.0.1 through 6.0.34. Remediation: upgrade to 7.0.42+ (or later), 8.0.31+ (or later...

CVE-2021-23177

CVE-2021-23177 concerns an improper link resolution flaw in libarchive when extracting archives. A crafted archive could trigger changes to the ACL of the link target, potentially allowing a local attacker to modify file ACLs and gain higher privileges. The vulnerability is described across multi...