CVE-2026-114096 Details
Description
Dulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in porcelain.checkout(paths=[...]) that allows attackers to write arbitrary files by abusing raw os.open without O_NOFOLLOW. Attackers can craft a repository where a worktree symlink points to .git/hooks/post-checkout, so restoring the file from a tag writes a malicious hook for code execution.
A symlink following vulnerability has been identified in Dulwich versions 0.24.0 prior to 1.2.8, specifically within the 'porcelain.checkout' function. This vulnerability allows attackers to write arbitrary files by exploiting the 'os.open' function without the 'O_NOFOLLOW' option. By crafting a repository with a worktree symlink that points to '.git/hooks/post-checkout', attackers can use this vulnerability to execute malicious code. When the file is restored from a tag, it writes a harmful hook that gets executed later.
Users can upgrade to Dulwich version 1.2.8 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 21, 2026CISA-ADP
Assessed Oct 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/jelmer/dulwich/security/advisories/GHSA-8w8g-wq8h-fq33 | CISA-ADP | AdvisoryExploitTechnical AnalysisVendor |
| https://github.com/jelmer/dulwich/security/advisories/GHSA-8w8g-wq8h-fq33 | [email protected] | AdvisoryExploitTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/dulwich-0.24.0-before-1.2.8-symlink-write-through-via-porcelain-checkout-paths | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-59 | Improper Link Resolution Before File Access ('Link Following') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Dulwich | >= 0.24.0, <= 1.2.7 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 28, 2026 | CVE Modified | CISA-ADP |
| Oct 21, 2026 | New CVE Received | [email protected] |