CVE-2026-54230
HIGH EPSS 2.3%
Published Jun 13, 20262w ago · Modified Jun 17, 20262w ago
7.0 CVSS 3.1
Published Jun 13, 2026 2w ago
Last Modified Jun 17, 2026 2w ago
Description
A symlink following vulnerability was found in the ABRT post-create event handler scripts in libreport. Event scripts write output files using shell redirections without the O_NOFOLLOW flag. If the target file is replaced with a symlink, the shell process running as root follows the symlink and writes content to the symlink target, allowing arbitrary file overwrites on the system.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Attack Vector Local
Attack Complexity High
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High
Threat Intelligence
EPSS Exploit Probability
2.3% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-59
References 2
- access.redhat.com https://access.redhat.com/security/cve/CVE-2026-54230
- bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=2488568
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.