Skip to main content

libreport CVE-2026-54230

| EUVDEUVD-2026-36639 HIGH
Improper Link Resolution Before File Access (CWE-59)
2026-06-13 redhat GHSA-gvjc-4rfj-mxxj
7.8
CVSS 3.1 · NVD
Share

Severity by source

Vendor (redhat) PRIMARY
HIGH
qualitative
NVD
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Local low-priv user (AV:L/PR:L); swapping the output file for a symlink requires winning a timing window so AC:H; root file overwrite enables privilege escalation giving C:H/I:H/A:H.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Red Hat
7.0 HIGH
qualitative

Primary rating from Vendor (redhat).

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

6
Analysis Updated
Jun 29, 2026 - 15:31 vuln.today
v3 (cvss_changed)
Analysis Updated
Jun 29, 2026 - 15:30 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jun 29, 2026 - 15:22 vuln.today
cvss_changed
CVSS changed
Jun 29, 2026 - 15:22 NVD
7.0 (HIGH) 7.8 (HIGH)
Analysis Generated
Jun 13, 2026 - 02:58 vuln.today
CVE Published
Jun 13, 2026 - 02:34 cve.org
HIGH 7.0

DescriptionNVD

A symlink following vulnerability was found in the ABRT post-create event handler scripts in libreport. Event scripts write output files using shell redirections without the O_NOFOLLOW flag. If the target file is replaced with a symlink, the shell process running as root follows the symlink and writes content to the symlink target, allowing arbitrary file overwrites on the system.

AnalysisAI

Local privilege escalation via arbitrary root-owned file overwrite affects libreport's ABRT post-create event handler scripts on Red Hat Enterprise Linux 6, 7, and 8. The event scripts write output using shell redirections that lack the O_NOFOLLOW flag, so a local low-privileged user who plants a symlink in a writable crash-dump path can cause the root shell to follow it and clobber any file on the system, which can be leveraged for full system compromise. SSVC rates technical impact as total, but there is no public exploit identified at time of analysis and EPSS is negligible (0.02%, 5th percentile).

Technical ContextAI

libreport is the reporting library behind ABRT (Automatic Bug Reporting Tool), the default crash-collection and reporting framework on Red Hat and Fedora systems. When a crash is captured, ABRT runs post-create event handler scripts as root to enrich the crash dump directory. These scripts emit data using ordinary POSIX shell output redirection (e.g. '> file'), which opens the destination without O_NOFOLLOW. This is a classic CWE-59 (Link Following / improper link resolution) flaw: because the dump directory is influenced by the unprivileged user whose process crashed, that user can replace an expected output filename with a symlink pointing at a sensitive system file. The privileged shell resolves the symlink and truncates/writes the target. The CPE set scopes exposure to Red Hat Enterprise Linux 6, 7, and 8.

RemediationAI

Apply Red Hat's updated libreport/abrt packages once available for your RHEL 6, 7, or 8 release, tracking the fix through the Red Hat advisory (https://access.redhat.com/security/cve/CVE-2026-54230) and Bugzilla 2488568 (https://bugzilla.redhat.com/show_bug.cgi?id=2488568); the corrected scripts should open output files with O_NOFOLLOW or otherwise refuse to follow symlinks. No exact fixed package version was provided in the input, so confirm the patched build from the vendor advisory rather than assuming a version. As a compensating control until patched, disable the ABRT processing path or the abrtd service (systemctl disable --now abrtd) so untrusted crash dumps are not processed as root - the trade-off is loss of automatic crash collection and bug reporting. Alternatively, tighten permissions on the crash spool directory (e.g. /var/spool/abrt) and restrict ABRT to trusted users so unprivileged users cannot pre-stage symlinks, accepting reduced crash-reporting coverage for general user processes.

CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft

CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-33845 CRITICAL
9.1 Apr 30

Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege

CVE-2026-16526 HIGH
8.8 Jul 30

Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe

CVE-2026-11610 HIGH
8.8 Jul 07

Denial of service in Red Hat / 389 Directory Server (389-ds-base, versions since ~1.3.2/2013) allows an authenticated LD

CVE-2026-14474 HIGH
8.8 Jul 07

Local-to-domain-wide root privilege escalation in SSSD's LDAP sudo provider allows an authenticated LDAP directory user

CVE-2026-52720 HIGH
8.8 Jun 15

Heap buffer overflow in GStreamer's librfb (RFB/VNC client) allows a malicious VNC server to corrupt heap memory on a co

CVE-2026-58222 HIGH
8.8 Jul 30

Confidential Active Directory attribute disclosure in Samba's Active Directory Domain Controller allows an authenticated

CVE-2026-5260 HIGH
8.2 May 26

Information disclosure and denial of service in GnuTLS (libgnutls) let a remote, unauthenticated attacker trigger a heap

CVE-2026-0966 HIGH
8.2 Mar 26

Remote denial-of-service in libssh 0.11.x and earlier allows unauthenticated attackers to crash SSH server daemon proces

CVE-2026-42013 HIGH
8.2 May 26

Here is the multi-source synthesis as a single JSON object: ```json { "product_name": "GnuTLS", "summary": "Certifi

CVE-2026-14476 HIGH
8.0 Jul 07

Privilege escalation to root and Kerberos-based authentication bypass in SSSD's Active Directory GPO provider affects Re

Vendor StatusVendor

Share

CVE-2026-54230 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy