{"id":"HSEC-2026-0006","aliases":[],"status":"published","title":"Cabal deletes project source files during configure","description":"# Cabal deletes project source files during configure\n\nThe `checkDuplicateHeaders` function in `Distribution.Simple.Configure` removes\nheader files from the source directory when a header with the same name exists in\nboth the build directory and the source directory.\n\nThis behavior was introduced in commit `3a9830b` to resolve header precedence\nissues, as C compilers prefer relative includes over `-I` search paths. The\nworkaround uses `removeFile` on source directory files, which is destructive and\nshould not happen during a build process.\n\nWhile the current implementation does not follow symlinks explicitly, the\ndeletion of source files outside of the project  during a build operation is\npossible on Microsoft Windows.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2026-04-08T14:23:27Z","modified":"2026-04-08T14:30:42Z","affected":[{"source":"osv","ecosystem":"Hackage","package":"Cabal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2"}]}],"versions":["2.2.0.0","2.2.0.1","2.4.0.0","2.4.0.1","2.4.1.0","3.0.0.0","3.0.1.0","3.0.2.0","3.10.1.0","3.10.2.0","3.10.2.1","3.10.3.0","3.12.0.0","3.12.1.0","3.14.0.0","3.14.1.0","3.14.1.1","3.14.2.0","3.16.0.0","3.16.1.0","3.2.0.0","3.2.1.0","3.4.0.0","3.4.1.0","3.6.0.0","3.6.1.0","3.6.2.0","3.6.3.0","3.8.1.0"]}],"references":[{"url":"https://github.com/haskell/cabal/issues/11176","tags":["report"]},{"url":"https://github.com/haskell/cabal/commit/3a9830bbdabef2f1009a69957966b778c7c1a9ee","tags":["introduced"]}],"sources":{"osv":[{"id":"HSEC-2026-0006","title":"Cabal deletes project source files during configure","description":"# Cabal deletes project source files during configure\n\nThe `checkDuplicateHeaders` function in `Distribution.Simple.Configure` removes\nheader files from the source directory when a header with the same name exists in\nboth the build directory and the source directory.\n\nThis behavior was introduced in commit `3a9830b` to resolve header precedence\nissues, as C compilers prefer relative includes over `-I` search paths. The\nworkaround uses `removeFile` on source directory files, which is destructive and\nshould not happen during a build process.\n\nWhile the current implementation does not follow symlinks explicitly, the\ndeletion of source files outside of the project  during a build operation is\npossible on Microsoft Windows.\n","status":"published","published":"2026-04-08T14:23:27Z","modified":"2026-04-08T14:30:42.599046Z","updated_at":"2026-11-02T15:47:17.805107Z"}]}}