CVE-2026-28684 Details
Description
python-dotenv reads key-value pairs from a .env file and can set them as environment variables. Prior to version 1.2.2, `set_key()` and `unset_key()` in python-dotenv follow symbolic links when rewriting `.env` files, allowing a local attacker to overwrite arbitrary files via a crafted symlink when a cross-device rename fallback is triggered. Users should upgrade to v.1.2.2 or, as a workaround, apply the patch manually.
A vulnerability in python-dotenv prior to version 1.2.2 allows for arbitrary file overwriting through symbolic link manipulation. The issue arises in the 'set_key()' and 'unset_key()' functions, which follow symlinks when rewriting '.env' files. This behavior can be exploited by a local attacker to overwrite files via a crafted symlink, particularly when a cross-device rename fallback is triggered. The vulnerability requires the application to have write access to the directory containing the target file, and for the '.env' file to be a symlink pointing to a writable file on the same device.
Users are advised to upgrade to python-dotenv version 1.2.2, where this vulnerability has been addressed. Instructions for applying the patch manually are also available.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/theskumar/python-dotenv/security/advisories/GHSA-mf9w-mj56-hr94 | CISA-ADP | ExploitPatchVendor Advisory |
| https://github.com/theskumar/python-dotenv/commit/790c5c02991100aa1bf41ee5330aca75edc51311 | [email protected] | Patch |
| https://github.com/theskumar/python-dotenv/releases/tag/v1.2.2 | [email protected] | Release Notes |
| https://github.com/theskumar/python-dotenv/security/advisories/GHSA-mf9w-mj56-hr94 | [email protected] | ExploitPatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-59 | Improper Link Resolution Before File Access ('Link Following') | [email protected] |
| CWE-61 | UNIX Symbolic Link (Symlink) Following | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| saurabh-kumar python-dotenv | < 1.2.2 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 27, 2026 | Initial Analysis | [email protected] |
| Apr 20, 2026 | CVE Modified | CISA-ADP |
| Apr 20, 2026 | New CVE Received | [email protected] |