Arbitrary File Write Vulnerability in Dulwich on Windows Systems

CVE-2026-114094

What is CVE-2026-114094?

Dulwich versions prior to 1.2.9 are susceptible to an arbitrary file write vulnerability on Windows systems. This issue arises from insufficient validation of DOS drive letter prefixes within Git tree path elements. An attacker can exploit this flaw by crafting a malicious Git repository with entries that include 'C:', allowing them to bypass NTFS validation. This exploitation can lead to writing files outside the designated worktree, potentially enabling remote code execution. Users are encouraged to update to the latest version of Dulwich to mitigate this risk.

References