CVE-2011-4617

Virtualenv Allows Symlink Attack on /tmp/

1.2 LowFix available

virtualenv.py in virtualenv before 1.5 allows local users to overwrite arbitrary files via a symlink attack on a certain file in /tmp/.

Exploit likelihood

0.31%Down 0.7 points since Feb 4, 2022

What each source reports

NVD Score used 1.2

virtualenv.py in virtualenv before 1.5 allows local users to overwrite arbitrary files via a symlink attack on a certain file in /tmp/.

Record: CVE-2011-4617
CVSS 2.0: 1.2 LowAV:L/AC:H/Au:N/C:N/I:P/A:N
Weakness: CWE-59
Updated: 2026-11-02

CVE List No score

virtualenv.py in virtualenv before 1.5 allows local users to overwrite arbitrary files via a symlink attack on a certain file in /tmp/.

Record: CVE-2011-4617
Updated: 2026-11-02

EUVDEUVD-2011-0025 No score

virtualenv.py in virtualenv before 1.5 allows local users to overwrite arbitrary files via a symlink attack on a certain file in /tmp/.

Record: EUVD-2011-0025
Updated: 2026-11-03

GitHub AdvisoriesGHSA-3jhc-wjqf-5f2c 6.9

Virtualenv Allows Symlink Attack on /tmp/

virtualenv.py in virtualenv before 1.5 allows local users to overwrite arbitrary files via a symlink attack on a certain file in /tmp/.

Record: GHSA-3jhc-wjqf-5f2c
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-59
Updated: 2026-11-02

OSVGHSA-3jhc-wjqf-5f2c 6.9

Virtualenv Allows Symlink Attack on /tmp/

virtualenv.py in virtualenv before 1.5 allows local users to overwrite arbitrary files via a symlink attack on a certain file in /tmp/.

Record: GHSA-3jhc-wjqf-5f2c
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-59
Updated: 2026-11-02

OSV No score

virtualenv.py in virtualenv before 1.5 allows local users to overwrite arbitrary files via a symlink attack on a certain file in /tmp/.

Record: CVE-2011-4617
Updated: 2026-11-02

OSVDEBIAN-CVE-2011-4617 No score

virtualenv.py in virtualenv before 1.5 allows local users to overwrite arbitrary files via a symlink attack on a certain file in /tmp/.

Record: DEBIAN-CVE-2011-4617
Updated: 2026-11-02

OSVPYSEC-2011-23 No score

virtualenv.py in virtualenv before 1.5 allows local users to overwrite arbitrary files via a symlink attack on a certain file in /tmp/.

Record: PYSEC-2011-23
Updated: 2026-11-02

Affected products

python virtualenv

Affected packages

Affected packages
Package	Affected	Fixed
`virtualenv` PyPI	before 1.5	1.5
`python-virtualenv` Debian:12	before 1.6-1	1.6-1
`python-virtualenv` Debian:13	before 1.6-1	1.6-1
`python-virtualenv` Debian:14	before 1.6-1	1.6-1
`virtualenv` PyPI	before 1.5, plus listed versions 0.80.8.10.8.20.8.30.8.4 Show 22 moreShow less 0.90.9.10.9.21.01.11.21.31.3.11.3.21.3.31.3.41.41.4.11.4.21.4.31.4.41.4.51.4.61.4.71.4.81.4.91.4rc1	1.5

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2011-4617 is a low vulnerability (CVSS 1.2) in Python Virtualenv, published December 31, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.31%, the 24th percentile. Fixed in virtualenv 1.5.

References

Show 8 moreShow less