Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local low-priv user (AV:L/PR:L); swapping the output file for a symlink requires winning a timing window so AC:H; root file overwrite enables privilege escalation giving C:H/I:H/A:H.
Primary rating from Vendor (redhat).
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
6DescriptionNVD
A symlink following vulnerability was found in the ABRT post-create event handler scripts in libreport. Event scripts write output files using shell redirections without the O_NOFOLLOW flag. If the target file is replaced with a symlink, the shell process running as root follows the symlink and writes content to the symlink target, allowing arbitrary file overwrites on the system.
AnalysisAI
Local privilege escalation via arbitrary root-owned file overwrite affects libreport's ABRT post-create event handler scripts on Red Hat Enterprise Linux 6, 7, and 8. The event scripts write output using shell redirections that lack the O_NOFOLLOW flag, so a local low-privileged user who plants a symlink in a writable crash-dump path can cause the root shell to follow it and clobber any file on the system, which can be leveraged for full system compromise. SSVC rates technical impact as total, but there is no public exploit identified at time of analysis and EPSS is negligible (0.02%, 5th percentile).
Technical ContextAI
libreport is the reporting library behind ABRT (Automatic Bug Reporting Tool), the default crash-collection and reporting framework on Red Hat and Fedora systems. When a crash is captured, ABRT runs post-create event handler scripts as root to enrich the crash dump directory. These scripts emit data using ordinary POSIX shell output redirection (e.g. '> file'), which opens the destination without O_NOFOLLOW. This is a classic CWE-59 (Link Following / improper link resolution) flaw: because the dump directory is influenced by the unprivileged user whose process crashed, that user can replace an expected output filename with a symlink pointing at a sensitive system file. The privileged shell resolves the symlink and truncates/writes the target. The CPE set scopes exposure to Red Hat Enterprise Linux 6, 7, and 8.
RemediationAI
Apply Red Hat's updated libreport/abrt packages once available for your RHEL 6, 7, or 8 release, tracking the fix through the Red Hat advisory (https://access.redhat.com/security/cve/CVE-2026-54230) and Bugzilla 2488568 (https://bugzilla.redhat.com/show_bug.cgi?id=2488568); the corrected scripts should open output files with O_NOFOLLOW or otherwise refuse to follow symlinks. No exact fixed package version was provided in the input, so confirm the patched build from the vendor advisory rather than assuming a version. As a compensating control until patched, disable the ABRT processing path or the abrtd service (systemctl disable --now abrtd) so untrusted crash dumps are not processed as root - the trade-off is loss of automatic crash collection and bug reporting. Alternatively, tighten permissions on the crash spool directory (e.g. /var/spool/abrt) and restrict ABRT to trusted users so unprivileged users cannot pre-stage symlinks, accepting reduced crash-reporting coverage for general user processes.
More in Red Hat Enterprise Linux 6
View allRemote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe
Denial of service in Red Hat / 389 Directory Server (389-ds-base, versions since ~1.3.2/2013) allows an authenticated LD
Local-to-domain-wide root privilege escalation in SSSD's LDAP sudo provider allows an authenticated LDAP directory user
Heap buffer overflow in GStreamer's librfb (RFB/VNC client) allows a malicious VNC server to corrupt heap memory on a co
Confidential Active Directory attribute disclosure in Samba's Active Directory Domain Controller allows an authenticated
Information disclosure and denial of service in GnuTLS (libgnutls) let a remote, unauthenticated attacker trigger a heap
Remote denial-of-service in libssh 0.11.x and earlier allows unauthenticated attackers to crash SSH server daemon proces
Here is the multi-source synthesis as a single JSON object: ```json { "product_name": "GnuTLS", "summary": "Certifi
Privilege escalation to root and Kerberos-based authentication bypass in SSSD's Active Directory GPO provider affects Re
Same weakness CWE-59 – Improper Link Resolution Before File Access
View allSame technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today
EUVD-2026-36639
GHSA-gvjc-4rfj-mxxj