CVE-2026-54230: Abrt: event handler scripts follow symlinks when writing output files, allowing arbitrary file overwrites

Synopsis

A symlink following vulnerability exists in the ABRT (Automatic Bug Reporting Tool) event handler scripts included in the libreport package on Red Hat Enterprise Linux 6, 7, and 8. An attacker with a low-privilege local account can exploit a race condition where event scripts write output files as root without checking for symlinks, allowing the attacker to redirect those writes to arbitrary files on the system. Successful exploitation gives the attacker read access to sensitive data, the ability to overwrite critical system files, and the potential to crash services or escalate privileges. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the affected service is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient to set up the symlink race; no elevated credentials are needed.

• Victim interactionNot required

  No user interaction is required; the attacker waits for the root-running event script to execute as part of normal ABRT operation.

• Attack complexityDetail

  Exploitation requires winning a race condition between the event script's file write and the attacker's symlink placement, making reliable triggering dependent on timing and environmental factors.

Blast Radius

• Reads arbitrary files on the host by redirecting root-owned script output to sensitive paths such as /etc/shadow or application credential files.
• Overwrites critical system files including init scripts, cron jobs, or SSH authorized_keys, enabling persistent access or privilege escalation.
• Corrupts or truncates configuration files, causing service failures or unexpected reboots on the affected host.