Medium, CVSS 6.6PyPIAmendedPublished
python-dotenv: Symlink following in set_key allows arbitrary file overwrite via cross-device rename fallback
CVE-2026-28684 · GHSA-mf9w-mj56-hr94
- Affected
- PyPI python-dotenv < 1.2.2
- Fixed in
- 1.2.2· Vendor fix available
- Issue
- setkey() and unsetkey() in python-dotenv follow symbolic links when rewriting .env files, allowing a local attacker to overwrite arbitrary files via a crafted symlink when a cross-device rename fallback is triggered. Details The rewrite() context manager in dotenv/main.py is used by both setkey() and unsetkey() to safely modify .env files. It works by writing to a temporary file (created in the system's default temp directory, typically /tmp) and then using shutil.move() to replace the original file. When the .env path is a symbolic link and the temp directory resides on a different filesystem than the target (a common configuration on Linux systems using tmpfs for /tmp), the following sequence occurs: 1. shutil.move() first attempts os.rename(), which fails with an OSError because atomic renames cannot cross device boundaries. 2. On failure, shutil.move() falls back to shutil.copy2() followed by os.unlink(). 3. shutil.copy2() calls shutil.copyfile() with followsymlinks=True…
Recommended action: Upgrade to 1.2.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.