—

PYSEC-2026-808

Fabric vulnerable to symlink attack on tmp files

Quick fix

PYSEC-2026-808 — fabric: upgrade to the fixed version with the command below.

pip install --upgrade 'fabric>=1.1.0'

Details

Fabric before 1.1.0 allows local users to overwrite arbitrary files via a symlink attack on (1) a `/tmp/fab.*.tar` file or (2) certain other files in the top level of `/tmp/`.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/fabric

Introduced in: 0Fixed in: 1.1.0

Fixpip install --upgrade 'fabric>=1.1.0'

References

https://nvd.nist.gov/vuln/detail/CVE-2011-2185[ADVISORY]
https://github.com/fabric/fabric/commit/3445b5653cd297039443110548fb3cab2e8e25af[WEB]
https://github.com/fabric/fabric/commit/d7470d2db919ffcee80c245cf87e6d8d4ba6909c[WEB]
https://bugzilla.redhat.com/show_bug.cgi?id=710462[WEB]
https://github.com/fabric/fabric[PACKAGE]
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=629003[WEB]
http://code.fabfile.org/projects/fabric/files/Fabric-1.1.0.tar.gz[WEB]
http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062534.html[WEB]
http://www.openwall.com/lists/oss-security/2011/06/03/5[WEB]
http://www.openwall.com/lists/oss-security/2011/06/06/12[WEB]
https://pypi.org/project/fabric[PACKAGE]
https://github.com/advisories/GHSA-xwg2-qc6c-7c3q[ADVISORY]