HSEC-2026-0006
Cabal deletes project source files during configure
Cabal deletes project source files during configure
The checkDuplicateHeaders function in Distribution.Simple.Configure removes
header files from the source directory when a header with the same name exists in
both the build directory and the source directory.
This behavior was introduced in commit 3a9830b to resolve header precedence
issues, as C compilers prefer relative includes over -I search paths. The
workaround uses removeFile on source directory files, which is destructive and
should not happen during a build process.
While the current implementation does not follow symlinks explicitly, the deletion of source files outside of the project during a build operation is possible on Microsoft Windows.
What each source reports
OSV No score
Cabal deletes project source files during configure
Cabal deletes project source files during configure
The checkDuplicateHeaders function in Distribution.Simple.Configure removes
header files from the source directory when a header with the same name exists in
both the build directory and the source directory.
This behavior was introduced in commit 3a9830b to resolve header precedence
issues, as C compilers prefer relative includes over -I search paths. The
workaround uses removeFile on source directory files, which is destructive and
should not happen during a build process.
While the current implementation does not follow symlinks explicitly, the deletion of source files outside of the project during a build operation is possible on Microsoft Windows.
- Record
HSEC-2026-0006- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
CabalHackage |
2.2 and later, plus listed versions 2.2.0.02.2.0.12.4.0.02.4.0.12.4.1.0 Show 24 moreShow less3.0.0.03.0.1.03.0.2.03.10.1.03.10.2.03.10.2.13.10.3.03.12.0.03.12.1.03.14.0.03.14.1.03.14.1.13.14.2.03.16.0.03.16.1.03.2.0.03.2.1.03.4.0.03.4.1.03.6.0.03.6.1.03.6.2.03.6.3.03.8.1.0 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
HSEC-2026-0006 is a vulnerability with no CVSS score yet in Cabal, published April 8, 2026. No source lists public exploit code. No source names a fixed version.