CVE-2026-113721 is a vulnerability in virtualenv where generated activation files and pyvenv.cfg can follow existing symbolic links and write outside the intended environment. This occurs because the code checks for file existence without handling dangling symlinks properly, allowing writes to arbitrary locations if an attacker can prepare links beforehand. The issue affects environment creation and seeding files, potentially overwriting files outside the virtual environment. The vulnerability requires that another user can place links in the destination and that the invoking user has write permissions to the linked targets. A fix is available in versions 1.2.2_1 and 2.5.1_1.