Vulnerabilities

TI-2026-39133 CVE-2026-54230 · GHSA-gvjc-4rfj-mxxj

Abrt: event handler scripts follow symlinks when writing output files, allowing arbitrary file overwrites

LOW 35

A symlink following vulnerability was found in the ABRT post-create event handler scripts in libreport.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00228 Published 2026-06-13 Partial fix · 2.1.11-62.el7_9, 2.10.9-26.el8_10 +3 CWE-59

TI-2026-39132 CVE-2026-54229 · GHSA-c3cq-8jxp-w66j

LOW 32

A race condition was found in the abrt-dbus D-Bus service's ChownProblemDir method.

CVSS 3.1HIGH 7.0 Local Low privileges No interaction EPSS 0.00124 Published 2026-06-13 Partial fix · 2.1.11-61.el7_9, 2.10.9-26.el8_10 +3 CWE-362

TI-2026-39131 CVE-2026-54228 · GHSA-6pjg-wmm6-r8rp

LOW 35

A time-of-check time-of-use (TOCTOU) race condition was found in the abrt-dbus D-Bus service's SetElement method.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00134 Published 2026-06-13 Partial fix · 2.1.11-61.el7_9, 2.10.9-26.el8_10 +3 CWE-367