CVE-2026-114098 Details
Description
Dulwich from 0.22.5 before 1.2.8 contains a path traversal vulnerability in stash.py pop() that allows attackers to write arbitrary files outside the worktree through intermediate directory symlinks. Attackers can craft a malicious repository whose popped stash writes a payload into .git/hooks/post-checkout, achieving code execution on the next checkout.
A path traversal vulnerability has been identified in Dulwich versions 0.22.5 prior to 1.2.8. The issue resides in the stash.py file, specifically within the pop() function. This vulnerability allows attackers to write arbitrary files outside the repository's worktree by exploiting intermediate directory symlinks. By crafting a malicious repository, an attacker can manipulate the stash pop operation to execute code on the victim's machine.
Users can upgrade to Dulwich version 1.2.8 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 21, 2026CISA-ADP
Assessed Oct 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/jelmer/dulwich/security/advisories/GHSA-cm62-gvxx-vmxx | [email protected] | AdvisoryTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/dulwich-0.22.5-before-1.2.8-path-traversal-via-stash-pop-symlinks | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Dulwich | >= 0.22.5, <= 1.2.7 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 27, 2026 | CVE Modified | CISA-ADP |
| Oct 21, 2026 | New CVE Received | [email protected] |