CVE-2026-54230
HighCVSS 7.0Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
A symlink following vulnerability was found in the ABRT post-create event handler scripts in libreport. Event scripts write output files using shell redirections without the O_NOFOLLOW flag, allowing arbitrary file overwrites via symlink replacement.
Risk Assessment
An attacker can overwrite arbitrary system files, potentially leading to privilege escalation, permanent system damage, or malicious code injection.
Recommendation
Immediately update libreport to a version where scripts use safe write mechanisms (e.g., O_NOFOLLOW) or apply temporary access restrictions to temporary directories.
Original NVD description (English source)
A symlink following vulnerability was found in the ABRT post-create event handler scripts in libreport. Event scripts write output files using shell redirections without the O_NOFOLLOW flag. If the target file is replaced with a symlink, the shell process running as root follows the symlink and writes content to the symlink target, allowing arbitrary file overwrites on the system.