CVE-2026-114098

Deferred Deferred - Pending Action

Path Traversal in Dulwich Git Library

Publication date: 2026-10-21

Last updated on: 2026-10-27

Assigner: VulnCheck

Description

Dulwich from 0.22.5 before 1.2.8 contains a path traversal vulnerability in stash.py pop() that allows attackers to write arbitrary files outside the worktree through intermediate directory symlinks. Attackers can craft a malicious repository whose popped stash writes a payload into .git/hooks/post-checkout, achieving code execution on the next checkout.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-27

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-114098

EUVD

EUVD-2026-106901

Affected Vendors & Products

Vendor	Product	Version / Range
jelmer	dulwich	0.22.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability is a path traversal issue in the Dulwich library's stash.py pop() function. It allows attackers to write arbitrary files outside the intended worktree by exploiting intermediate directory symlinks. A crafted malicious repository can write a payload into .git/hooks/post-checkout during a stash pop operation, which executes code the next time a git checkout occurs.

Detection Guidance

Check Dulwich version with pip show dulwich. If version is between 0.22.5 and 1.2.7, the system is vulnerable. Inspect .git/hooks/post-checkout for unexpected modifications or files outside the repository.

Impact Analysis

If you use a vulnerable version of Dulwich (0.22.5 to 1.2.7), an attacker could trick you into cloning a malicious repository and performing a stash pop operation. This could lead to arbitrary code execution on your system when you next run a git checkout, potentially compromising your machine.

Compliance Impact

This vulnerability could lead to unauthorized file writes outside the intended worktree, potentially exposing sensitive data or allowing code execution. For GDPR, this may result in unauthorized access to personal data, violating confidentiality and integrity requirements. For HIPAA, it could allow unauthorized modifications to protected health information, compromising data integrity and security.

Mitigation Strategies

Upgrade Dulwich to version 1.2.8 or later. Avoid popping stashes from untrusted repositories. Review .git/hooks/post-checkout for suspicious changes. Monitor filesystem for unauthorized file writes.

Hi! I’m here to help you understand CVE-2026-114098. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...