PT-2026-33800 · Pypi · Python-Dotenv

Tsigouris007 · Published 2026-04-20 · Updated 2026-06-11 · CVE-2026-28684

Positive Technologies (AI Summary)

CVSS v3.1

6.6

Medium

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions python-dotenv versions prior to 1.2.2

Description The set key() and unset key() functions in python-dotenv follow symbolic links when rewriting .env files. This occurs when the rewrite() context manager in dotenv/main.py writes to a temporary file in the system default directory and attempts to move it to the target location using shutil.move(). If the target is a symbolic link and the temporary directory is on a different filesystem, shutil.move() falls back to shutil.copy2(), which follows symbolic links by default. A local attacker with write access to the directory containing the .env file can create a crafted symlink to overwrite arbitrary files that the application process has permission to modify, potentially leading to integrity violations, denial of service, or privilege escalation.

Recommendations Upgrade to version 1.2.2.

Exploit

Fix

Link Following

Weakness Enumeration

CWE-61

CWE-59

Related Identifiers

CVE-2026-28684

GHSA-MF9W-MJ56-HR94

OESA-2026-2198

OESA-2026-2199

OESA-2026-2324

OPENSUSE-SU-2026:20952-1

Affected Products

Python-Dotenv

References · 24

• 🔥 https://github.com/theskumar/python-dotenv/security/advisories/GHSA-mf9w-mj56-hr94 · Exploit
• https://github.com/theskumar/python-dotenv/commit/790c5c02991100aa1bf41ee5330aca75edc51311 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-28684 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-28684 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2324 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2198 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-28684 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20952-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-28684 · Security Note
• https://osv.dev/vulnerability/GHSA-mf9w-mj56-hr94 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-28684 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2199 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2026-28684 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28684 · Security Note
• https://github.com/theskumar/python-dotenv · Note