CVE-2026-114094 Details
Description
Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrary file write. Attackers can craft a malicious repository with a tree entry named 'C:' that bypasses NTFS validation and writes files outside the worktree to achieve remote code execution.
A vulnerability in Dulwich versions prior to 1.2.9 allows for arbitrary file writes on Windows systems. This issue arises because the software fails to properly validate DOS drive letter prefixes in Git tree paths. Attackers can create a malicious repository with a tree entry labeled 'C:', which bypasses NTFS path validation. When this repository is cloned, Dulwich writes files outside the designated worktree, potentially leading to remote code execution. The vulnerability exploits the checkout process by introducing a path that the application does not correctly sanitize, allowing files to be written to sensitive locations such as the user's home directory or system startup folders.
Users are advised to update to Dulwich version 1.2.9 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 21, 2026CISA-ADP
Assessed Oct 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/jelmer/dulwich/security/advisories/GHSA-8mcx-5rqc-vhmf | CISA-ADP | AdvisoryExploitRemedyTechnical AnalysisVendor |
| https://github.com/jelmer/dulwich/security/advisories/GHSA-8mcx-5rqc-vhmf | [email protected] | AdvisoryExploitRemedyTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/dulwich-before-1.2.9-arbitrary-file-write-via-dos-drive-letter-paths | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Dulwich | < 1.2.9 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 28, 2026 | CVE Modified | CISA-ADP |
| Oct 21, 2026 | New CVE Received | [email protected] |