CVE-2026-28684 — Link Following in Python-dotenv

CWE-59 — Link FollowingCWE-61 — UNIX Symbolic Link (Symlink) Following9 documents5 sources
Severity
6.6MEDIUMNVD
EPSS
0.0%
top 98.77%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
61
Theskumar Python-dotenvAnsible-automation-platform-24 Lightspeed-rhel8Ansible-automation-platform-25 Lightspeed-chatbot-rhel8+58 more
Timeline
PublishedApr 20
Latest updateApr 22

Description

python-dotenv reads key-value pairs from a .env file and can set them as environment variables. Prior to version 1.2.2, `set_key()` and `unset_key()` in python-dotenv follow symbolic links when rewriting `.env` files, allowing a local attacker to overwrite arbitrary files via a crafted symlink when a cross-device rename fallback is triggered. Users should upgrade to v.1.2.2 or, as a workaround, apply the patch manually.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:HExploitability: 1.3 | Impact: 5.2

Affected Packages63 packages

▶CVEListV5theskumar/python-dotenv< 1.2.2

🔴Vulnerability Details

2
GHSA
python-dotenv: Symlink following in set_key allows arbitrary file overwrite via cross-device rename fallback↗2026-04-21
▶
VulDB
theskumar python-dotenv up to 1.2.1 set_key/unset_key link following (GHSA-mf9w-mj56-hr94)↗2026-04-20
▶

📋Vendor Advisories

1
Red Hat
python-dotenv: python-dotenv: Arbitrary file overwrite via symbolic link following↗2026-04-20
▶

💬Community

5
Bugzilla
CVE-2026-28684 python-dotenv: python-dotenv: Arbitrary file overwrite via symbolic link following [epel-all]↗2026-04-22
▶
Bugzilla
CVE-2026-28684 python-dotenv: python-dotenv: Arbitrary file overwrite via symbolic link following [fedora-all]↗2026-04-22
▶
Bugzilla
CVE-2026-28684 python-dotenv: python-dotenv: Arbitrary file overwrite via symbolic link following [fedora-42]↗2026-04-22
▶
Bugzilla
CVE-2026-28684 python-dotenv: python-dotenv: Arbitrary file overwrite via symbolic link following [fedora-43]↗2026-04-22
▶
Bugzilla
CVE-2026-28684 python-dotenv: python-dotenv: Arbitrary file overwrite via symbolic link following↗2026-04-20
▶
CVE-2026-28684 — Link Following in Python-dotenv | cvebase