CVE-2026-114097: Dulwich 0.23.1 before 1.2.8 Symlink Path Traversal via filter_branch Index Filter

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-21 · updated 2026-10-22
Weakness: CWE-22

Description

Dulwich from 0.23.1 before 1.2.8 contains a path traversal vulnerability in CommitFilter._apply_index_filter() that allows attackers to write files outside the working directory via symlinks persisting between commits. Attackers can craft a repository where an ancestor commit's symlink redirects a descendant commit's file writes during filter_branch, enabling code execution by writing into .git/hooks.

Affected products

Pypi Dulwich: from 0.23.1 before 1.2.8; 0.23.1, 0.23.2, 0.24.0, 0.24.1, 0.24.10, 0.24.2 (+20) — fixed in 1.2.8
jelmer dulwich: from 0.23.1 before 1.2.8 — fixed in 1.2.8

How to fix

Upgrade to a fixed version: Pypi Dulwich 1.2.8; jelmer dulwich 1.2.8. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-114097 or the next vulnerability affects your stack