CVE-2026-54231CWE-74

CVE-2026-54231

Medium · published June 13, 2026

CVSS v3.1
5.5
EPSS
0%
Percentile
8.5
In the wild
Unconfirmed
What it is

A content injection vulnerability was found in the ABRT post-create event handler scripts in libreport. The event script queries the systemd journal for log entries matching the crashed process and writes the results to files in the dump directory without sanitizing embedded control characters. A local user can inject arbitrary content into the journal output by embedding newline characters in syslog messages, controlling the content that root writes to dump directory files.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00193 · 8.5th percentile
Weakness
CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Published
2026-06-13T07:16Z
Affected products (5)
ProductVersionsFixed in
redhat/automatic_bug_reporting_toolall versions—
fedoraproject/fedoraall versions—
fedoraproject/fedoraall versions—
redhat/enterprise_linuxall versions—
redhat/enterprise_linuxall versions—
References (6)
https://access.redhat.com/errata/RHSA-2026:54272 · [email protected]https://access.redhat.com/errata/RHSA-2026:69115 · [email protected]https://access.redhat.com/errata/RHSA-2026:69116 · [email protected]https://access.redhat.com/errata/RHSA-2026:69117 · [email protected]https://access.redhat.com/security/cve/CVE-2026-54231 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2488571 · [email protected]
EPSS history
Timeline
  • 13 JUN 02:34Z
    Abrt: unsanitized systemd journal content written to dump directory files enables content injection
    cvelistv5