CVE-2026-114097

Deferred Deferred - Pending Action

Path Traversal in Dulwich Git Library

Publication date: 2026-10-21

Last updated on: 2026-10-22

Assigner: VulnCheck

Description

Dulwich from 0.23.1 before 1.2.8 contains a path traversal vulnerability in CommitFilter._apply_index_filter() that allows attackers to write files outside the working directory via symlinks persisting between commits. Attackers can craft a repository where an ancestor commit's symlink redirects a descendant commit's file writes during filter_branch, enabling code execution by writing into .git/hooks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-22

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-114097

EUVD

EUVD-2026-106900

Affected Vendors & Products

Vendor	Product	Version / Range
jelmer	dulwich	0.23.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability is a path traversal issue in Dulwich's CommitFilter._apply_index_filter() function. It allows attackers to write files outside the intended working directory by exploiting symlinks that persist between commits. When using filter_branch with an index filter, a symlink in an ancestor commit can redirect file writes in descendant commits to arbitrary filesystem locations, including .git/hooks for potential code execution.

Detection Guidance

To detect this vulnerability, check if your system uses Dulwich versions between 0.23.1 and 1.2.7. Run: dulwich --version. If the version is in this range, the system is vulnerable. Additionally, inspect repositories processed with filter_branch for unexpected file writes or symlinks in .git/hooks.

Impact Analysis

This vulnerability can allow attackers to write malicious files outside the intended directory, including into .git/hooks which could lead to arbitrary code execution. It affects users of Dulwich versions 0.23.1 through 1.2.7 when using filter_branch with an index filter.

Compliance Impact

This vulnerability could lead to unauthorized file writes outside the intended directory, potentially exposing sensitive data stored in .git/hooks or other locations. This may violate GDPR's data integrity and confidentiality requirements or HIPAA's safeguards for protected health information if exploited.

Mitigation Strategies

Upgrade Dulwich to version 1.2.8 or later immediately. If upgrading is not possible, avoid using filter_branch with untrusted repositories. Review .git/hooks for unauthorized files and remove any suspicious entries.

Hi! I’m here to help you understand CVE-2026-114097. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...