Local privilege escalation via symlinked path components

Symlink traversal in attr project attr before 2.6.0 allows local users to redirect privileged getfattr or setfattr access to unintended files. During directory walking and backup restoration, the utilities resolve full pathnames and follow attacker-controlled symbolic links instead of using directory-relative, link-safe operations. Exploitation requires control of a pathname component and a privileged process invoking a vulnerable utility, enabling unauthorized reads or changes to files accessible to that process.