Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2026-114094

Dulwich before 1.2.9 Arbitrary File Write via DOS drive letter paths

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrary file write. Attackers can craft a malicious repository with a tree entry named 'C:' that bypasses NTFS validation and writes files outside the worktree to achieve remote code execution.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

jelmer dulwich

Default version status: unaffected

  • 0 to < 1.2.9affected
  • 1.2.9unaffected
pkg:pypi/dulwich

References