Symlink Traversal in ACL File Operations Enables Privilege Escalation

CVE-2026-54369 is a symlink traversal vulnerability affecting the libacl library before version 2.4.0. The vulnerability exists in pathname-based ACL functions (acl_get_file, acl_set_file, acl_extended_file, and acl_delete_def_file) that fail to properly validate symbolic links during file operations. Local attackers who can control any component of a pathname processed by a privileged application can redirect ACL operations to arbitrary files or directories, leading to unauthorized privilege escalation and access control manipulation. This affects systems running vulnerable versions of libacl, particularly in multi-user environments where unprivileged users can influence filesystem paths or in containerized deployments where privilege boundaries are exploited.

While CVE-2026-54369 does not map directly to current MITRE ATT&CK techniques, Casky's extended reasoning capabilities would identify this vulnerability through detection of access control abuse patterns and file system manipulation behaviors. Practitioners using Casky would observe findings related to suspicious ACL modifications on files outside expected directories, unexpected symlink creation in monitored paths, and privilege escalation attempts through file operation redirection. The platform's 754 mapped security skills enable detection of the underlying attack pattern—local privilege escalation via filesystem tricks—by correlating unusual ACL access patterns, symlink presence in critical paths, and privilege context changes during file operations. Organizations should prioritize upgrading libacl and implementing file integrity monitoring to detect symlink-based traversal attempts.