The acl utility prior to version 2.4.0 suffers from a TOCTOU race condition that allows an attacker who can influence a pathname component to replace it with a symbolic link. During the execution of privileged operations such as getfacl, setfacl, or chacl, the program performs a lstat() check and later follows the symlink when calling stat(), chown(), chmod(), acl_get_file(), or acl_set_file(), enabling the attacker to redirect access‑control list modifications to an arbitrary target file. This flaw results in local privilege escalation because the privileged process can alter the permissions or ownership of files chosen by the attacker.

The vulnerability affects the acl project’s acl utility for all versions earlier than 2.4.0. Users running these older releases on any Linux or Unix‑derived system are exposed if they employ getfacl, setfacl, or chacl with paths that an attacker can control.

With a CVSS score of 7.2 the vulnerability is considered high severity. EPSS data is not available, and the issue is not currently listed in CISA’s Known Exploited Vulnerabilities catalog. The attack vector is local; an attacker must be able to write or control a pathname component to insert a symlink before the privileged command is issued. Once this condition is met, the exploitation is straightforward and grants the attacker the privileges of the executing process.