Skip to content
OpenAdvisories
Unscored HSEC-2026-0006

Cabal deletes project source files during configure

Published Apr 8, 2026 · Updated Apr 8, 2026 · Assigned by HSEC

Description

# Cabal deletes project source files during configure

The `checkDuplicateHeaders` function in `Distribution.Simple.Configure` removes
header files from the source directory when a header with the same name exists in
both the build directory and the source directory.

This behavior was introduced in commit `3a9830b` to resolve header precedence
issues, as C compilers prefer relative includes over `-I` search paths. The
workaround uses `removeFile` on source directory files, which is destructive and
should not happen during a build process.

While the current implementation does not follow symlinks explicitly, the
deletion of source files outside of the project during a build operation is
possible on Microsoft Windows.

Affected packages

EcosystemPackageAffectedFixedRecord
Hackage Cabal >= 2.2 — HSEC-2026-0006

References