CVE-2026-54230: Abrt: event handler scripts follow symlinks when writing output files, allowing arbitrary file overwrites
A symlink following vulnerability was found in the ABRT post-create event handler scripts in /etc/libreport/events.d/abrtevent.conf. Event scripts write output files using shell redirections (e.g., "printf ... > $DUMPDIR/varlogmessages") which use open() with OWRONLY|OCREAT|OTRUNC without the ONOFOLLOW flag. If the target file is replaced with a symlink, the shell process (running as root in the abrthandleeventt SELinux domain, which is effectively unconfined) follows the symlink and writes content to the symlink target. In contrast, ddsavetext (used by SetElement) correctly uses ONOFOLLOW. An attacker who has gained filesystem control of the dump directory can replace output files with symlinks pointing to sensitive system files such as /var/spool/cron/root.
Other sources
A symlink following vulnerability was found in the ABRT post-create event handler scripts in libreport. Event scripts write output files using shell redirections without the ONOFOLLOW flag. If the target file is replaced with a symlink, the shell process running as root follows the symlink and writes content to the symlink target, allowing arbitrary file overwrites on the system.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify the ABRT event handler scripts that currently write output via shell redirections (e.g., "> $DUMP_DIR/var_log_messages") so they use dd_save_text or the SetElement helper (which opens files with O_NOFOLLOW) or otherwise open output files with O_NOFOLLOW to avoid following symlinks.
libreport ABRT post-create event handler scripts output write method = use dd_save_text/SetElement (uses O_NOFOLLOW) - Compensating control
Prevent untrusted users from having filesystem control of the dump directory: ensure the dump directory is owned and writable only by trusted/root accounts and adjust permissions/ACLs so unprivileged users cannot create or replace files there (thereby preventing creation of malicious symlinks).
- Operational
Audit the dump directory for symlinks and check sensitive targets that could have been overwritten (for example /var/spool/cron/root) for unauthorized changes; remove any malicious symlinks from the dump directory and restore affected files from known-good backups if modifications are found.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-54230?
The severity of CVE-2026-54230 is rated high with a score of 7.
How do I fix CVE-2026-54230?
To fix CVE-2026-54230, ensure that the ABRT event handler scripts do not follow symlinks when writing to output files by modifying the configuration.
What does CVE-2026-54230 affect?
CVE-2026-54230 affects Red Hat ABRT and Red Hat libreport due to symlink following in event handler scripts.
What type of vulnerability is CVE-2026-54230?
CVE-2026-54230 is a symlink following vulnerability that allows arbitrary file overwrites.
What are the potential impacts of CVE-2026-54230?
The potential impacts of CVE-2026-54230 include unauthorized access to files and possible data loss through arbitrary file overwrites.