Abrt: event handler scripts follow symlinks when writing output files, allowing arbitrary file overwrites (CVE-2026-54230)

Abrt: event handler scripts follow symlinks when writing output files, allowing arbitrary file overwrites (CVE-2026-54230) | HOL Guard CVE

Why this deserves its current priority

CVSS is 7.0. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps Red Hat/abrt (generic). Check affected ranges and fixed versions before updating.

Affected products and reported versions
Product	Affected versions	Fixed versions
cpe:2.3:a:redhat:automatic_bug_reporting_tool::::::::	Not reported	Not reported
cpe:2.3:o:fedoraproject:fedora:43:::::::*	Not reported	Not reported
cpe:2.3:o:fedoraproject:fedora:44:::::::*	Not reported	Not reported
cpe:2.3:o:redhat:enterprise_linux:7.0:::::::*	Not reported	Not reported
cpe:2.3:o:redhat:enterprise_linux:8.0:::::::*	Not reported	Not reported

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
Red Hat/abrtgeneric	*	Not reported

Recommended response

Check inventory. Check lockfiles and deployed manifests for Red Hat/abrt.
Review the reported fix. Source-reported workaround: The following practices would help for avoiding exposure and mitigate this flaw: - Disable or remove ABRT if it is not required. On RHEL 8 systems where ABRT is installed, it can be disabled with: systemctl disable --now abrtd.service abrt-journal-core.service abrt-oops.service abrt-xorg.service - On Fedora systems, consider using systemd-coredump instead of ABRT for crash handling - Restrict local user access to systems running ABRT, as this vulnerability requires local access

Evidence timeline and material changes

Published upstream
Jun 13, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Sep 21, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Jun 29, 2026

Sources and claim methodology

Upstream source description

A symlink following vulnerability was found in the ABRT post-create event handler scripts in libreport. Event scripts write output files using shell redirections without the O_NOFOLLOW flag. If the target file is replaced with a symlink, the shell process running as root follows the symlink and writes content to the symlink target, allowing arbitrary file overwrites on the system.

Quoted source text, attributed separately from HOL analysis.

Abrt: event handler scripts follow symlinks when writing output files, allowing arbitrary file overwrites

Key facts

Why this deserves its current priority

Affected scope and exposure questions

Recommended response

Evidence timeline and material changes

Sources and claim methodology

Related CVEs