Abrt: unsanitized systemd journal content written to dump directory files enables content injection (CVE-2026-54231) | HOL Guard CVE

Medium · CVSS 5.5CVE-2026-54231

Abrt: unsanitized systemd journal content written to dump directory files enables content injection

Answer in brief

CVE-2026-54231 records a Medium severity (CVSS 5.5) vulnerability in Abrt: unsanitized systemd journal content written to dump directory files enables content injection. The current sources do not mark it as known exploited. The current feed maps Red Hat/abrt (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Jun 13, 2026Updated Sep 21, 2026Source checked Sep 26, 2026First seen by HOL Jun 29, 2026Material review Sep 21, 2026

Upstream Advisory

Key facts

Risk: Medium · CVSS 5.5
Exploitation: Not marked as known exploited
Affected software: 6 mapped packages or products
Fix availability: Not reported

Why this deserves its current priority

CVSS is 5.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps Red Hat/abrt (generic). Check affected ranges and fixed versions before updating.

Affected products and reported versions
Product	Affected versions	Fixed versions
cpe:2.3:a:redhat:automatic_bug_reporting_tool::::::::	Not reported	Not reported
cpe:2.3:o:fedoraproject:fedora:43:::::::*	Not reported	Not reported
cpe:2.3:o:fedoraproject:fedora:44:::::::*	Not reported	Not reported
cpe:2.3:o:redhat:enterprise_linux:7.0:::::::*	Not reported	Not reported
cpe:2.3:o:redhat:enterprise_linux:8.0:::::::*	Not reported	Not reported

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
Red Hat/abrtgeneric	*	Not reported

Recommended response

Check inventory. Check lockfiles and deployed manifests for Red Hat/abrt.
Review the reported fix. Source-reported workaround: The following practices would help for avoiding exposure and mitigate this flaw: - Disable or remove ABRT if it is not required. On RHEL 8 systems where ABRT is installed, it can be disabled with: systemctl disable --now abrtd.service abrt-journal-core.service abrt-oops.service abrt-xorg.service - On Fedora systems, consider using systemd-coredump instead of ABRT for crash handling - Restrict local user access to systems running ABRT, as this vulnerability requires local access

Evidence timeline and material changes

Published upstream
Jun 13, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Sep 21, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Jun 29, 2026

Sources and claim methodology

Upstream source description

A content injection vulnerability was found in the ABRT post-create event handler scripts in libreport. The event script queries the systemd journal for log entries matching the crashed process and writes the results to files in the dump directory without sanitizing embedded control characters. A local user can inject arbitrary content into the journal output by embedding newline characters in syslog messages, controlling the content that root writes to dump directory files.

Quoted source text, attributed separately from HOL analysis.