Bug 2459798 (CVE-2026-28684)

Summary: CVE-2026-28684 python-dotenv: python-dotenv: Arbitrary file overwrite via symbolic link following
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: alinfoot, anpicker, anthomas, aprice, bbrownin, bparees, caswilli, dfreiber, drow, dschmidt, dtrifiro, ebourniv, ehelms, erezende, ggainey, hasun, ilpinto, jburrell, jfula, jkoehler, jlanda, jowilson, jsamir, juwatts, jwong, kaycoth, kshier, lgallett, lphiri, ltomasbo, mbarnett, mhayden, mhulan, nmoumoul, nyancey, oezr, omaciel, ometelka, osousa, pcreech, ptisnovs, rbryant, rchan, rjohnson, sbunciak, sdoran, simaishi, smallamp, smcdonal, stcannon, syedriko, teagle, tmalecek, ttakamiy, vkumar, weaton, xdharmai, yguenane, ykashtan
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in python-dotenv. A local attacker can exploit this by crafting a symbolic link, which the `set_key()` and `unset_key()` functions in python-dotenv follow when rewriting `.env` files. This can lead to the overwriting of arbitrary files on the system.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2460548, 2460549, 2460551, 2460552    
Bug Blocks:    

Description OSIDB Bzimport 2026-04-20 17:02:41 UTC
python-dotenv reads key-value pairs from a .env file and can set them as environment variables. Prior to version 1.2.2, `set_key()` and `unset_key()` in python-dotenv follow symbolic links when rewriting `.env` files, allowing a local attacker to overwrite arbitrary files via a crafted symlink when a cross-device rename fallback is triggered. Users should upgrade to v.1.2.2 or, as a workaround, apply the patch manually.