Directory Traversal Vulnerability in Dulwich by JElmer
CVE-2026-47712

3.3LOW

Key Information:

Vendor

Jelmer

Status
Dulwich
Vendor
CVE Published:
10 June 2026

What is CVE-2026-47712?

Dulwich is a pure-Python implementation of Git file formats and protocols that was vulnerable to a directory traversal flaw. This issue arose when generating patch filenames from commit subject lines, allowing an attacker to manipulate the filename and potentially direct the output to unintended directories. Specifically, certain characters were not sanitized, enabling malicious subjects to escape the intended output directory. This vulnerability has been addressed in version 1.2.5, where the method for deriving filenames has been fortified to ensure that only safe characters are used, thereby mitigating the risk of file system traversal. Users are advised to upgrade to the latest version to ensure their systems remain secure against this vector.

Affected Version(s)

dulwich >= 0.24.0, < 1.2.5

References

https://github.com/jelmer/dulwich/security/advisories/GHS...
x_refsource_CONFIRM
https://github.com/jelmer/dulwich/commit/c2446e51b
x_refsource_MISC
https://github.com/jelmer/dulwich/releases/tag/dulwich-1.2.5
x_refsource_MISC

CVSS V3.1

Score:
3.3
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.