By vendor

Abrt_project vulnerabilities

Known CVEs affecting Abrt_project products, prioritized by severity, with SEC.co remediation and detection guidance.

2 published vulnerabilities

• CVE-2026-54230HIGH 7.0

  A vulnerability in libreport's ABRT (Automatic Bug Reporting Tool) event handler scripts allows a local attacker with limited privileges to overwrite arbitrary files on a system. The flaw occurs because event scripts use file output redirection without protective measures that would prevent following symbolic links. An attacker can replace a target file with a symlink pointing to a sensitive system file, then trigger an ABRT event. Since the event scripts run as root, they unwittingly follow the symlink and write data to the attacker's chosen location, potentially corrupting critical system files or planting malicious content.

• CVE-2026-54231MEDIUM 5.5

  A local user can inject arbitrary content into system log files processed by the Automatic Bug Reporting Tool (ABRT) in libreport. When a program crashes, ABRT collects diagnostic information from the system journal. However, the scripts that gather this information don't properly filter out special characters that control log formatting. An attacker with local access can embed newline characters in their own log messages, which ABRT then reads and writes to its crash dump directory files without cleaning them up. This allows the attacker to manipulate files that root processes create, potentially altering important diagnostic records or injecting misleading content into crash reports.