2488568 – (CVE-2026-54230) CVE-2026-54230 abrt: event handler scripts follow symlinks when writing output files, allowing arbitrary file overwrites

Bug 2488568 (CVE-2026-54230) - CVE-2026-54230 abrt: event handler scripts follow symlinks when writing output files, allowing arbitrary file overwrites

Summary: CVE-2026-54230 abrt: event handler scripts follow symlinks when writing outpu...

Keywords:
Status:	NEW
Alias:	CVE-2026-54230
Product:	Security Response
Classification:	Other
Component:	vulnerability
Sub Component:
Version:	unspecified
Hardware:	All
OS:	Linux
Priority:	high
Severity:	high
Target Milestone:	---
Assignee:	Product Security DevOps Team
QA Contact:
Docs Contact:
URL:
Whiteboard:
Depends On:	2488619
Blocks:
TreeView+	depends on / blocked

Reported:	2026-06-12 21:02 UTC by OSIDB Bzimport
Modified:	2026-09-21 04:15 UTC (History)
CC List:	2 users (show)
Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments	(Terms of Use)

Links
System	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2026:54272	None	None	None	2026-08-12 11:09:27 UTC
Red Hat Product Errata	RHSA-2026:69115	None	None	None	2026-09-21 03:11:23 UTC
Red Hat Product Errata	RHSA-2026:69116	None	None	None	2026-09-21 03:01:36 UTC
Red Hat Product Errata	RHSA-2026:69117	None	None	None	2026-09-21 03:34:28 UTC
Red Hat Product Errata	RHSA-2026:69121	None	None	None	2026-09-21 04:15:19 UTC

Description OSIDB Bzimport 2026-06-12 21:02:55 UTC

A symlink following vulnerability was found in the ABRT post-create event handler scripts in /etc/libreport/events.d/abrt_event.conf. Event scripts write output files using shell redirections (e.g., "printf ... > $DUMP_DIR/var_log_messages") which use open() with O_WRONLY|O_CREAT|O_TRUNC without the O_NOFOLLOW flag. If the target file is replaced with a symlink, the shell process (running as root in the abrt_handle_event_t SELinux domain, which is effectively unconfined) follows the symlink and writes content to the symlink target. In contrast, dd_save_text (used by SetElement) correctly uses O_NOFOLLOW. An attacker who has gained filesystem control of the dump directory can replace output files with symlinks pointing to sensitive system files such as /var/spool/cron/root.

Comment 2 errata-xmlrpc 2026-08-12 11:09:26 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:54272 https://access.redhat.com/errata/RHSA-2026:54272

Comment 3 Jon Orris 2026-09-21 03:01:35 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

Via RHSA-2026:69116 https://access.redhat.com/errata/RHSA-2026:69116

Comment 4 Jon Orris 2026-09-21 03:11:22 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On

Via RHSA-2026:69115 https://access.redhat.com/errata/RHSA-2026:69115

Comment 5 Jon Orris 2026-09-21 03:34:27 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2026:69117 https://access.redhat.com/errata/RHSA-2026:69117

Comment 6 Jon Orris 2026-09-21 04:15:18 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Extended Lifecycle Support

Via RHSA-2026:69121 https://access.redhat.com/errata/RHSA-2026:69121

Note You need to log in before you can comment on or make changes to this bug.