Affected versions of the python-dotenv package are vulnerable to Arbitrary File Overwrite due to unsafe symlink handling in the rewrite() context manager used by set_key() and unset_key() in dotenv/main.py. When the target .env path is a symbolic link and the system temporary directory resides on a different filesystem, shutil.move() falls back to shutil.copy2(), which follows symlinks by default and writes the new content to the symlink target rather than replacing the symlink itself. A local attacker with write access to the directory containing a .env file can pre-place a symlink pointing to any file writable by the process, causing a subsequent call to set_key() or unset_key() to deterministically overwrite the target with attacker-controlled .env content, resulting in integrity loss, Denial of Service, and potential privilege escalation when the consuming process runs with elevated privileges.

Affected versions of the python-dotenv package are vulnerable to Arbitrary File Overwrite due to unsafe symlink handling in the rewrite() context manager used by set_key() and unset_key() in dotenv/main.py. When the target .env path is a symbolic link and the system temporary directory resides on a different filesystem, shutil.move() falls back to shutil.copy2(), which follows symlinks by default and writes the new content to the symlink target rather than replacing the symlink itself. A local attacker with write access to the directory containing a .env file can pre-place a symlink pointing to any file writable by the process, causing a subsequent call to set_key() or unset_key() to deterministically overwrite the target with attacker-controlled .env content, resulting in integrity loss, Denial of Service, and potential privilege escalation when the consuming process runs with elevated privileges.

Affected versions of the python-dotenv package are vulnerable to Arbitrary File Overwrite due to unsafe symlink handling in the rewrite() context manager used by set_key() and unset_key() in dotenv/main.py. When the target .env path is a symbolic link and the system temporary directory resides on a different filesystem, shutil.move() falls back to shutil.copy2(), which follows symlinks by default and writes the new content to the symlink target rather than replacing the symlink itself. A local attacker with write access to the directory containing a .env file can pre-place a symlink pointing to any file writable by the process, causing a subsequent call to set_key() or unset_key() to deterministically overwrite the target with attacker-controlled .env content, resulting in integrity loss, Denial of Service, and potential privilege escalation when the consuming process runs with elevated privileges.

Affected versions of the python-dotenv package are vulnerable to Arbitrary File Overwrite due to unsafe symlink handling in the rewrite() context manager used by set_key() and unset_key() in dotenv/main.py. When the target .env path is a symbolic link and the system temporary directory resides on a different filesystem, shutil.move() falls back to shutil.copy2(), which follows symlinks by default and writes the new content to the symlink target rather than replacing the symlink itself. A local attacker with write access to the directory containing a .env file can pre-place a symlink pointing to any file writable by the process, causing a subsequent call to set_key() or unset_key() to deterministically overwrite the target with attacker-controlled .env content, resulting in integrity loss, Denial of Service, and potential privilege escalation when the consuming process runs with elevated privileges.

Affected versions of the python-dotenv package are vulnerable to Arbitrary File Overwrite due to unsafe symlink handling in the rewrite() context manager used by set_key() and unset_key() in dotenv/main.py. When the target .env path is a symbolic link and the system temporary directory resides on a different filesystem, shutil.move() falls back to shutil.copy2(), which follows symlinks by default and writes the new content to the symlink target rather than replacing the symlink itself. A local attacker with write access to the directory containing a .env file can pre-place a symlink pointing to any file writable by the process, causing a subsequent call to set_key() or unset_key() to deterministically overwrite the target with attacker-controlled .env content, resulting in integrity loss, Denial of Service, and potential privilege escalation when the consuming process runs with elevated privileges.

Affected versions of the python-dotenv package are vulnerable to Arbitrary File Overwrite due to unsafe symlink handling in the rewrite() context manager used by set_key() and unset_key() in dotenv/main.py. When the target .env path is a symbolic link and the system temporary directory resides on a different filesystem, shutil.move() falls back to shutil.copy2(), which follows symlinks by default and writes the new content to the symlink target rather than replacing the symlink itself. A local attacker with write access to the directory containing a .env file can pre-place a symlink pointing to any file writable by the process, causing a subsequent call to set_key() or unset_key() to deterministically overwrite the target with attacker-controlled .env content, resulting in integrity loss, Denial of Service, and potential privilege escalation when the consuming process runs with elevated privileges.