ABRT post‑create event handler scripts in libreport generate output files via shell redirections without the O_NOFOLLOW flag. If a user replaces a target file with a symlink, the root‑running shell follows the symlink and writes data to the link’s real destination, enabling an attacker to overwrite any file they can influence through a symlink. The flaw lies in improper handling of symlinks (CWE‑59).

Red Hat Enterprise Linux 6, 7, and 8 are affected. The vulnerability resides in the ABRT component that runs as root on these distributions.

The CVSS score of 7 indicates a high severity, and although the EPSS score is not available, the lack of KEV listing suggests limited current exploitation. Attackers must have local access to a system that has ABRT installed and trigger event handlers that write files, typically by raising a crash event. If successful, they can overwrite arbitrary files, representing a severe integrity breach on a system with root privileges.