Arbitrary File Write Vulnerability in Dulwich Git Implementation by Jelmer
CVE-2026-42305
What is CVE-2026-42305?
Dulwich, a pure-Python implementation of Git, allows for arbitrary file write leading to remote code execution when untrusted Git repositories are cloned or checked out on Windows. Versions from 0.10.0 to 1.2.4 contain flaws in the path-element validation, permitting filenames that Windows misinterprets as structural syntax. Additionally, important configuration options for NTFS and HFS protection were not correctly utilized, resulting in user settings being ignored. This vulnerability affects users cloning or fetching potentially malicious repositories. Users are advised to upgrade to Dulwich version 1.2.5 or later for a fix, as older versions do not effectively mitigate the issue, even with available configurations.
Affected Version(s)
dulwich >= 0.10.0, < 1.2.5