CVE-2026-54231
published 2026-06-13CVE-2026-54231: A content injection vulnerability was found in the ABRT post-create event handler scripts in libreport. The event script queries the systemd journal for log…
PriorityP430medium5.5CVSS 3.1
AVLACLPRLUINSUCNIHAN
EPSS
0.12%
1.9th percentile
A content injection vulnerability was found in the ABRT post-create event handler scripts in libreport. The event script queries the systemd journal for log entries matching the crashed process and writes the results to files in the dump directory without sanitizing embedded control characters. A local user can inject arbitrary content into the journal output by embedding newline characters in syslog messages, controlling the content that root writes to dump directory files.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| abrt | abrt | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Red Hat Enterprise Linux 6/7/8 injection (EUVD-2026-36640)
vuldb·2026-06-13·CVSS 5.5
CVE-2026-54231 [MEDIUM] Red Hat Enterprise Linux 6/7/8 injection (EUVD-2026-36640)
A vulnerability has been found in Red Hat Enterprise Linux 6/7/8 and classified as critical. Impacted is an unknown function. The manipulation leads to injection.
This vulnerability is listed as CVE-2026-54231. The attack must be carried out locally. There is no available exploit.
GHSA
A content injection vulnerability was found in the ABRT post-create event handler scripts in libreport.
ghsa_unreviewed·2026-06-13
CVE-2026-54231 [MEDIUM] CWE-74 A content injection vulnerability was found in the ABRT post-create event handler scripts in libreport.
A content injection vulnerability was found in the ABRT post-create event handler scripts in libreport. The event script queries the systemd journal for log entries matching the crashed process and writes the results to files in the dump directory without sanitizing embedded control characters. A local user can inject arbitrary content into the journal output by embedding newline characters in syslog messages, controlling the content that root writes to dump directory files.
Red Hat
abrt: unsanitized systemd journal content written to dump directory files enables content injection
vendor_redhat·2026-05-04·CVSS 5.5
CVE-2026-54231 [MEDIUM] CWE-74 abrt: unsanitized systemd journal content written to dump directory files enables content injection
abrt: unsanitized systemd journal content written to dump directory files enables content injection
A content injection vulnerability was found in the ABRT post-create event handler scripts in libreport. The event script queries the systemd journal for log entries matching the crashed process and writes the results to files in the dump directory without sanitizing embedded control characters. A local user can inject arbitrary content into the journal output by embedding newline characters in syslog messages, controlling the content that root writes to dump directory files.
Statement: Red Hat is aware of this vulnerability affecting ABRT event handler scripts in libreport. ABRT was deprecated in Red Hat Enterprise Linux 8 and is not available in Red Hat Enterprise Linux 9 or later. Users
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-54231 abrt: unsanitized systemd journal content written to dump directory files enables content injection [fedora-all]
bugzilla·2026-06-12
CVE-2026-54231 [MEDIUM] CVE-2026-54231 abrt: unsanitized systemd journal content written to dump directory files enables content injection [fedora-all]
CVE-2026-54231 abrt: unsanitized systemd journal content written to dump directory files enables content injection [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-54231 abrt: unsanitized systemd journal content written to dump directory files enables content injection
bugzilla·2026-06-12
CVE-2026-54231 [MEDIUM] CVE-2026-54231 abrt: unsanitized systemd journal content written to dump directory files enables content injection
CVE-2026-54231 abrt: unsanitized systemd journal content written to dump directory files enables content injection
A content injection vulnerability was found in the ABRT post-create event handler scripts. The event script queries the systemd journal for log entries matching the crashed process using journalctl with _COMM and _UID filters, and writes the results to files in the dump directory (e.g., var_log_messages). Any local user can pre-populate the systemd journal with entries whose _COMM matches common process names (e.g., "sleep") by using prctl(PR_SET_NAME) and syslog(). By embedding newline characters (\n) in syslog messages, the attacker can inject arbitrary content that appears on its own line in the journalctl output. While the event script filters out audit lines, it does not
2026-06-13
Published