A vulnerability in virtualenv's builtin environment creator allows writes outside the intended environment directory when directory symlinks are present. This occurs because the ensure_dir() function follows existing symlinks and writes environment files through them, potentially affecting directories controlled by another user. The issue affects versions prior to 1.2.2_1 and 2.5.1_1 and has a medium severity rating.