VDB

CVE-2026-54230

CVE-2026-54230 PUBLISHED CVSS 7 HIGH

Reported by redhat · Published June 13, 2026

A symlink following vulnerability was found in the ABRT post-create event handler scripts in libreport. Event scripts write output files using shell redirections without the O_NOFOLLOW flag. If the target file is replaced with a symlink, the shell process running as root follows the symlink and writes content to the symlink target, allowing arbitrary file overwrites on the system.

Risk Scores

CVSS 3.1
7
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected Products

VendorProductVersions
Red HatRed Hat Enterprise Linux 7 Extended Lifecycle Support0:2.1.11-62.el7_9
Red HatRed Hat Enterprise Linux 80:2.10.9-26.el8_10
Red HatRed Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support0:2.10.9-25.el8_4.2
Red HatRed Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On0:2.10.9-25.el8_4.2
Red HatRed Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support0:2.10.9-25.el8_6.2
Red HatRed Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On0:2.10.9-25.el8_6.2
Red HatRed Hat Enterprise Linux 8.8 Telecommunications Update Service0:2.10.9-25.el8_8.2
Red HatRed Hat Enterprise Linux 8.8 Update Services for SAP Solutions0:2.10.9-25.el8_8.2
Red HatRed Hat Enterprise Linux 6
Red HatRed Hat Enterprise Linux 6
Red HatRed Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On0:2.10.9-25.el8_6.2
Red HatRed Hat Enterprise Linux 7 Extended Lifecycle Support0:2.1.11-62.el7_9
Red HatRed Hat Enterprise Linux 7
Red HatRed Hat Enterprise Linux 8.8 Update Services for SAP Solutions0:2.10.9-25.el8_8.2
Red HatRed Hat Enterprise Linux 80:2.10.9-26.el8_10
Red HatRed Hat Enterprise Linux 7
Red HatRed Hat Enterprise Linux 6
Red HatRed Hat Enterprise Linux 8
Red HatRed Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On0:2.10.9-25.el8_4.2
Red HatRed Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support0:2.10.9-25.el8_6.2

…and 5 more

Timeline

  • Jun 13, 2026 Coalition ESS Score
  • Jun 13, 2026 CVE Published
  • Jun 15, 2026 EPSS Score
  • Jun 15, 2026 Security Advisory
  • Aug 7, 2026 EPSS Score
  • Aug 12, 2026 Distribution Patch
  • Aug 12, 2026 Security Advisory
  • Aug 20, 2026 Distribution Patch
  • Aug 24, 2026 EPSS Score
  • Sep 9, 2026 EPSS Score
  • Sep 16, 2026 EPSS Score
  • Sep 21, 2026 CVE Updated

References

Open in Interactive Console →
$ Console Community · 50/day Open console ›