Path Traversal Vulnerability in Dulwich by GitVendor

CVE-2026-114097

What is CVE-2026-114097?

The Dulwich library, versions prior to 1.2.8, contains a path traversal vulnerability in the CommitFilter._apply_index_filter() function. This flaw enables attackers to write files outside the intended working directory. By leveraging symlinks that persist between commits, an attacker can craft a malicious repository. Specifically, they can make an ancestor commit's symlink redirect a descendant commit's file writes during the filter_branch operation, potentially leading to unauthorized code execution by manipulating .git/hooks.

References