{"id":"CVE-2026-28684","title":"python-dotenv: python-dotenv: Arbitrary file overwrite via symbolic link following (CVE-2026-28684)","summary":"A flaw was found in python-dotenv. A local attacker can exploit this by crafting a symbolic link, which the `set_key()` and `unset_key()` functions in python-dotenv follow when rewriting `.env` files. This can lead to the overwriting of ar…","severity":"high","cvss":7.1,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","cvssSource":"vendor","cwe":"CWE-59","vendor":"Red Hat","product":"Red Hat OpenShift AI 3.3","affected":["lightspeed_core","openshift_lightspeed","ai_inference_server","ansible_automation_platform 2","enterprise_linux_ai_rhel_ai 3","openshift_ai_rhoai","satellite 6","ai_inference_server 3.2","ansible_automation_platform 2.6","migration_toolkit_for_applications 8.2","openshift_ai 2.25","openshift_ai 3.3","satellite 6.18"],"patched":["ai_inference_server 3.2","ansible_automation_platform 2.6","migration_toolkit_for_applications 8.2","openshift_ai 2.25","openshift_ai 3.3","satellite 6.18"],"published":"2026-04-20","updated":"2026-10-15","sourceUpdated":"2026-10-15T11:34:44+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28684.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28684.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-28684"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2459798"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-28684"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28684"},{"url":"https://github.com/theskumar/python-dotenv/commit/790c5c02991100aa1bf41ee5330aca75edc51311"},{"url":"https://github.com/theskumar/python-dotenv/releases/tag/v1.2.2"},{"url":"https://github.com/theskumar/python-dotenv/security/advisories/GHSA-mf9w-mj56-hr94"},{"url":"https://access.redhat.com/errata/RHSA-2026:61628"},{"url":"https://access.redhat.com/errata/RHSA-2026:24866"},{"url":"https://access.redhat.com/errata/RHSA-2026:43038"},{"url":"https://access.redhat.com/errata/RHSA-2026:42644"},{"url":"https://access.redhat.com/errata/RHSA-2026:24977"},{"url":"https://access.redhat.com/errata/RHSA-2026:19712"},{"url":"https://access.redhat.com/errata/RHSA-2026:73987"},{"url":"https://access.redhat.com/errata/RHSA-2026:37275"},{"url":"https://access.redhat.com/errata/RHSA-2026:26226"},{"url":"https://github.com/theskumar/python-dotenv/commit/790c5c02991100aa1bf41ee5330aca75edc51311.patch"},{"url":"https://github.com/theskumar/python-dotenv"}],"tags":["csaf","vex","red-hat","osv","pip"],"epss":0.00252,"epssPercentile":0.16628,"aliases":["GHSA-mf9w-mj56-hr94","PYSEC-2026-2270"],"ecosystem":"pip","scores":{"vendor":7.1,"osv":6.6},"ingestedAt":"2026-07-13T18:58:00.624Z","slug":"CVE-2026-28684","body":"## Overview\n\nA flaw was found in python-dotenv. A local attacker can exploit this by crafting a symbolic link, which the `set_key()` and `unset_key()` functions in python-dotenv follow when rewriting `.env` files. This can lead to the overwriting of arbitrary files on the system.\n\n## Vendor advisories\n\n- **RHSA-2026:61628** · Red Hat · fixed in: Red Hat AI Inference Server 3.2 · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61628)\n- **RHSA-2026:24866** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 · released 2026-06-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:24866)\n- **RHSA-2026:43038** · Red Hat · fixed in: Red Hat Migration Toolkit for Applications 8.2 · released 2026-07-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:43038)\n- **RHSA-2026:42644** · Red Hat · fixed in: Red Hat OpenShift AI 2.25 · released 2026-07-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:42644)\n- **RHSA-2026:24977** · Red Hat · fixed in: Red Hat OpenShift AI 2.25 · released 2026-06-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:24977)\n- **RHSA-2026:19712** · Red Hat · fixed in: Red Hat OpenShift AI 3.3 · released 2026-05-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:19712)\n- **RHSA-2026:73987** · Red Hat · fixed in: Red Hat OpenShift AI 3.3 · released 2026-09-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:73987)\n- **RHSA-2026:37275** · Red Hat · fixed in: Red Hat OpenShift AI 3.3 · released 2026-07-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:37275)\n- **RHSA-2026:26226** · Red Hat · fixed in: Red Hat Satellite 6.18 · released 2026-06-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:26226)\n- **Red Hat VEX** · Moderate · affected: Lightspeed Core, OpenShift Lightspeed, Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI), … · no fix planned: Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, Red Hat Satellite 6, Lightspeed Core, … · updated 2026-10-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28684.json)\n\n**python-dotenv: python-dotenv: Arbitrary file overwrite via symbolic link following** — rated Moderate by Red Hat. Released 2026-04-20, updated 2026-10-15.\n\nAffected:\n\n- Lightspeed Core\n- OpenShift Lightspeed\n- Red Hat AI Inference Server\n- Red Hat Ansible Automation Platform 2\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat Satellite 6\n\nFixed:\n\n- Red Hat AI Inference Server 3.2\n- Red Hat Ansible Automation Platform 2.6\n- Red Hat Migration Toolkit for Applications 8.2\n- Red Hat OpenShift AI 2.25\n- Red Hat OpenShift AI 3.3\n- Red Hat Satellite 6.18\n\nNo fix planned:\n\n- Red Hat AI Inference Server\n- Red Hat Ansible Automation Platform 2\n- Red Hat Satellite 6\n- Lightspeed Core\n- OpenShift Lightspeed\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Red Hat OpenShift AI (RHOAI)\n\nNot affected:\n\n- Red Hat Ansible Automation Platform 2.6\n- Red Hat Migration Toolkit for Applications 8.2\n- Red Hat OpenShift AI 2.25\n- Red Hat OpenShift AI 3.3\n- OpenShift Lightspeed\n- Red Hat OpenShift AI (RHOAI)\n\n## Remediation\n\nFor more information visit https://access.redhat.com/errata/RHSA-2026:61628 https://access.redhat.com/errata/RHSA-2026:61628\nBefore applying this update, make sure all previously released errata relevant to your system have been applied.\nFor details on how to apply this update, refer to:\nhttps://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6#Upgrade https://access.redhat.com/errata/RHSA-2026:24866\nBefore applying this update, make sure all previously released errata\nrelevant to your system have been applied. https://access.redhat.com/errata/RHSA-2026:43038\n\nWorkarounds / mitigations:\n\n- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.\n\n## Package advisory (CVE-2026-28684)\n\nAffected packages:\n\n- `python-dotenv < 1.2.2`\n\nPatched in:\n\n- `python-dotenv 1.2.2`\n\nSource: https://osv.dev/vulnerability/GHSA-mf9w-mj56-hr94","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":39.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":214196,"id":"CVE-2026-28684","ts":1790841349170,"field":"cvss","old":"6.6","new":"7.1"},{"seq":214195,"id":"CVE-2026-28684","ts":1790841349170,"field":"severity","old":"medium","new":"high"}]}