Path Traversal Vulnerability in Dulwich by Python Software Foundation
CVE-2026-114098

7.3HIGH

Key Information:

Vendor

Jelmer

Status
Dulwich
Vendor
CVE Published:
21 October 2026

What is CVE-2026-114098?

Dulwich, a Python library for Git, contains a path traversal flaw in the stash.py pop() method. This vulnerability enables attackers to manipulate intermediate directory symlinks to write arbitrary files outside the intended worktree. By crafting a malicious repository, an attacker can effectively use the popped stash to inject payloads into critical files such as .git/hooks/post-checkout, which could lead to code execution on subsequent Git checkouts.

Affected Version(s)

dulwich 0.22.5 < 1.2.8

dulwich 1.2.8

References

https://github.com/jelmer/dulwich/security/advisories/GHS...
vendor-advisory
https://www.vulncheck.com/advisories/dulwich-0.22.5-befor...
third-party-advisory

CVSS V4

Score:
7.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

manus-use
jelmer
.