Symlink Following Vulnerability in Dulwich by PII
CVE-2026-114096

7.3HIGH

Key Information:

Vendor

Jelmer

Status
Dulwich
Vendor
CVE Published:
21 October 2026

What is CVE-2026-114096?

The vulnerability in Dulwich involves a symlink following flaw within the porcelain.checkout method. This security issue allows attackers to exploit raw os.open calls to bypass the O_NOFOLLOW restriction. By crafting a malicious repository, an attacker can create a worktree symlink pointing to .git/hooks/post-checkout. When a file from a tag is restored, the malicious hook is written, enabling the potential for unauthorized code execution.

Affected Version(s)

dulwich 0.24.0 < 1.2.8

dulwich 1.2.8

References

https://github.com/jelmer/dulwich/security/advisories/GHS...
vendor-advisory
https://www.vulncheck.com/advisories/dulwich-0.24.0-befor...
third-party-advisory

CVSS V4

Score:
7.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

manus-use
jelmer
.