It exists that the process_report() function in data/whoopsie-upload-all allowed arbitrary file writes via symlinks.
canonical apport