CVE-2026-28684
MediumAdvisory
Published 20 Apr 2026In the index since 5 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 6.6
- base score, highest
- EPSS
- 0.003
- 17th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 162
- of 17,781 indexed, latest versions
- Container images
- 158
- deployed by those charts
- Fix available
- 1 of 2
- affected packages
python-dotenv: Symlink following in set_key allows arbitrary file overwrite via cross-device rename fallback
Carried by container images the latest versions of 162 of 17,781 indexed charts deploy, on 158 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| python-dotenvpypi | 0.9.1, 0.10.3, 0.11.0, 0.13.0+15 more | 1.2.2 | 158 |
| python-dotenvdeb | 0.9.1-1, 0.19.2-1 | no fix listed | 2 |
- OSV records
- GHSA-mf9w-mj56-hr94UBUNTU-CVE-2026-28684
- Also known as
- PYSEC-2026-2270
Charts affected
162 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| take-the-helmtake-the-helm | 0.1.0 | 1 of 1See more | 805 |
| flask-contactstest-configmap | 1.0.1 | 1 of 3See more | 5,704 |
| chatqnatest-opea | 1.0.0 | 1 of 11See more | 39,090 |
| docsumtest-opea | 1.0.0 | 1 of 5See more | 28,858 |
| guardrails-usvctest-opea | 1.0.0 | 1 of 1See more | 5,221 |
| retriever-usvctest-opea | 1.0.0 | 1 of 1See more | 5,198 |
| web-retrievertest-opea | 1.0.0 | 1 of 1See more | 5,350 |
| thanhvt27-lab-k8sthanh-vtVerified publisher | 0.1.4 | 1 of 5See more | 4,661 |
| kasa-exporterth-chartsVerified publisher | 0.1.0 | 1 of 1See more | 1,515 |
| zookeepertwomartensVerified publisher | 0.2.2 | 1 of 1See more | 1,733 |
| calibre-webvista | 0.1.3 | 1 of 1See more | 7,628 |
| supersetwbstack | 0.1.0 | 1 of 1See more | 7,085 |
Container images carrying it
158 by charts deploying them
A fixed version is listed for 1 of the 2 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| john19968010/ | 31a90f6bd69c | python-dotenv | 1.2.2 | 1 |
| kyovint/ | 48c19e3ae9a3 | python-dotenv | 1.2.2 | 1 |
| kyovint/ | 80084149156e | python-dotenv | 1.2.2 | 1 |
| langgenius/ | 066035f93856 | python-dotenv | 1.2.2 | 1 |
| langgenius/ | fca918260dd6 | python-dotenv | 1.2.2 | 1 |
| langgenius/ | 8269050f192e | python-dotenv | 1.2.2 | 1 |
| librenms/ | 0920bc9117a8 | python-dotenv | 1.2.2 | 1 |
| librenms/ | 4f1f3d667cc7 | python-dotenv | 1.2.2 | 1 |
| linuxserver/ | f7d7c7704249 | python-dotenv | 1.2.2 | 1 |
| linuxserver/ | 241009026e6f | python-dotenv | 1.2.2 | 1 |
| litellm/ | 09b217802ded | python-dotenv | 1.2.2 | 1 |
| lnbitsdocker/ | 26fae6327477 | python-dotenv | 1.2.2 | 1 |
| lnbitsdocker/ | a11aaa6d2b21 | python-dotenv | 1.2.2 | 1 |
| lncm/ | bca14d04397d | python-dotenv | 1.2.2 | 1 |
| localstack/ | 9d278167f2b7 | python-dotenv | 1.2.2 | 1 |
| lsstsqre/ | 79b00fb67a65 | python-dotenv | 1.2.2 | 1 |
| makersquad/ | a40dd258c527 | python-dotenv | 1.2.2 | 1 |
| marcoimme/ | b6035c0721a8 | python-dotenv | 1.2.2 | 1 |
| mediagis/ | c15e941485ef | python-dotenv python-dotenv | no fix listed 1.2.2 | 1 |
| mediagis/ | d0eae7b51374 | python-dotenv python-dotenv | no fix listed 1.2.2 | 1 |
| milesmcc/ | ba54f7797a6b | python-dotenv | 1.2.2 | 1 |
| milesmcc/ | e821e31140f7 | python-dotenv | 1.2.2 | 1 |
| miltex/ | dab12a7748d5 | python-dotenv | 1.2.2 | 1 |
| mintproject/ | 67d2f2103085 | python-dotenv | 1.2.2 | 1 |
| mintproject/ | 02260d20a21f | python-dotenv | 1.2.2 | 1 |
| moreillon/ | bacb2ddd8394 | python-dotenv | 1.2.2 | 1 |
| opea/ | 262c6048aab8 | python-dotenv | 1.2.2 | 1 |
| opea/ | f68bec6a1271 | python-dotenv | 1.2.2 | 1 |
| opea/ | 02f9e8fa5d71 | python-dotenv | 1.2.2 | 1 |
| opea/ | fe08165d7770 | python-dotenv | 1.2.2 | 1 |
| opencsghq/ | 2f03fead54db | python-dotenv | 1.2.2 | 1 |
| opencsghq/ | af7191a9cf8a | python-dotenv | 1.2.2 | 1 |
| opencsghq/ | 2cd29671a03e | python-dotenv | 1.2.2 | 1 |
| opencsghq/ | c36a5bac3cf0 | python-dotenv | 1.2.2 | 1 |
| openmined/ | b72f74a68b32 | python-dotenv | 1.2.2 | 1 |
| openzaak/ | 2e65313b9b10 | python-dotenv | 1.2.2 | 1 |
| openzaak/ | 2ca2ea6e0ae9 | python-dotenv | 1.2.2 | 1 |
| phan2410/ | 9c6ed6de26ca | python-dotenv | 1.2.2 | 1 |
| pysga1996/ | fdeec30ad482 | python-dotenv | 1.2.2 | 1 |
| redash/ | 00d813437db5 | python-dotenv | 1.2.2 | 1 |
| redash/ | c5c9148f5c38 | python-dotenv | 1.2.2 | 1 |
| rommapp/ | b909e95d1aab | python-dotenv | 1.2.2 | 1 |
| salehmir/ | 1afa95f979e9 | python-dotenv | 1.2.2 | 1 |
| sharanalwar/ | 8d3cab80df49 | python-dotenv | 1.2.2 | 1 |
| sirrend/ | 699e79e3d4e2 | python-dotenv | 1.2.2 | 1 |
| sruthitanneru/ | e565ea454ffd | python-dotenv | 1.2.2 | 1 |
| substratusai/ | 61695be635eb | python-dotenv | 1.2.2 | 1 |
| taigaio/ | 36318831b3e7 | python-dotenv | 1.2.2 | 1 |
| thelande/ | a1fdb8baa152 | python-dotenv | 1.2.2 | 1 |
| timescale/ | e8d0a9cc3db5 | python-dotenv | 1.2.2 | 1 |