CVE-2011-2185: Fabric symlink attack on tmp files
Summary
CVE-2011-2185: Fabric vulnerable to symlink attack on tmp files. Affects fabric versions < 1.1.0. Fixed in 1.1.0. How to fix ↓
Also tracked for
- fabric · Debian:11
The same CVE-2011-2185 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Fabric is a Python library and command-line tool designed to streamline the use of SSH for application deployment or systems administration tasks. It provides a high-level API for executing remote commands over SSH connections. However, versions before 1.1.0 of Fabric are vulnerable to a symlink attack on temporary files. This vulnerability allows local users to overwrite arbitrary files by exploiting symlinks on certain files in the top level of the /tmp/ directory.
Vulnerability Detail
The vulnerability in Fabric arises from the insecure handling of temporary files. Specifically, it allows an attacker with local access to the system to create symbolic links to arbitrary files in the /tmp/ directory. By doing so, the attacker can overwrite these files with malicious content, potentially leading to privilege escalation or unauthorized access to sensitive information. This vulnerability has a moderate severity rating and is assigned the Common Weakness Enumeration (CWE) ID 59.
How To Fix
Latest published version: 3.2.3 as of 22 Oct 2026
pip install --upgrade "fabric==3.2.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.1.0
This is the first release that contains the fix.
pip install --upgrade "fabric==1.1.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of Fabric is not immediately feasible, users can implement a workaround by manually securing the /tmp/ directory. This can be achieved by setting appropriate permissions and ownership for the directory and its contents. Additionally, it is advisable to regularly clean up the /tmp/ directory to remove any potential symlink vulnerabilities.
Conclusion
Fabric versions before 1.1.0 are vulnerable to a symlink attack on temporary files. This can allow local users to overwrite arbitrary files, potentially leading to unauthorized access or privilege escalation. It is recommended to upgrade to the latest version of Fabric (1.1.0 or later) to fix this vulnerability. Alternatively, users can implement a workaround by securing the /tmp/ directory and regularly cleaning up its contents. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for fabric →
FAQ
Fabric is a Python library and command-line tool used for SSH-based remote execution and deployment tasks.
A symlink attack, also known as a symbolic link attack, involves the exploitation of symbolic links to gain unauthorized access or manipulate files.
This vulnerability allows local users to overwrite arbitrary files, potentially leading to privilege escalation or unauthorized access to sensitive information.
To fix this vulnerability, upgrade to version 1.1.0 or later of Fabric. Alternatively, secure the /tmp/ directory and regularly clean up its contents.
Yes, users can secure the /tmp/ directory manually and regularly clean up its contents to mitigate the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for fabric.
