PT-2026-33609 · Hackage · Cabal

Published 2026-04-08 · Updated 2026-04-08

OSV

Cabal deletes project source files during configure

The checkDuplicateHeaders function in Distribution.Simple.Configure removes header files from the source directory when a header with the same name exists in both the build directory and the source directory.

This behavior was introduced in commit 3a9830b to resolve header precedence issues, as C compilers prefer relative includes over -I search paths. The workaround uses removeFile on source directory files, which is destructive and should not happen during a build process.

While the current implementation does not follow symlinks explicitly, the deletion of source files outside of the project during a build operation is possible on Microsoft Windows.

Related Identifiers

HSEC-2026-0006

Affected Products

Cabal

References · 5

• https://osv.dev/vulnerability/HSEC-2026-0006 · Vendor Advisory
• https://github.com/haskell/cabal/issues/11176 · Note
• https://github.com/haskell/cabal/commit/3a9830bbdabef2f1009a69957966b778c7c1a9ee · Note
• https://github.com/haskell/security-advisories · Note
• https://raw.githubusercontent.com/haskell/security-advisories/refs/heads/generated/osv-export · Note