{"id":"CVE-2026-114097","title":"Dulwich 0.23.1 before 1.2.8 Symlink Path Traversal via filter_branch Index Filter","summary":"Dulwich from 0.23.1 before 1.2.8 contains a path traversal vulnerability in CommitFilter._apply_index_filter() that allows attackers to write files outside the working directory via symlinks persisting between commits. Attackers can craf…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-22"],"vendor":"jelmer","product":"dulwich","affected":["dulwich >= 0.23.1 < 1.2.8"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-22T15:51:27.066995Z"},"published":"2026-10-21","updated":"2026-10-22","sourceUpdated":"2026-10-22T15:51:35.497Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-114097","references":[{"url":"https://github.com/jelmer/dulwich/security/advisories/GHSA-5fqc-mrg8-w798","label":"GitHub Security Advisory (GHSA-5fqc-mrg8-w798)"},{"url":"https://www.vulncheck.com/advisories/dulwich-0.23.1-before-1.2.8-symlink-path-traversal-via-filter-branch-index-filter","label":"VulnCheck Advisory: Dulwich 0.23.1 before 1.2.8 Symlink Path Traversal via filter_branch Index Filter"},{"url":"https://github.com/jelmer/dulwich/commit/9571ac60b851fce228dae7ededb380c6ce9b3fb8"},{"url":"https://github.com/jelmer/dulwich"},{"url":"https://github.com/jelmer/dulwich/releases/tag/dulwich-1.2.8"}],"tags":["cve.org","osv","pip"],"epss":0.00186,"epssPercentile":0.08139,"aliases":["GHSA-5fqc-mrg8-w798"],"ecosystem":"pip","patched":["dulwich 1.2.8"],"scores":{"cna":7.8,"osv":8.6},"ingestedAt":"2026-10-21T01:37:08.016Z","slug":"CVE-2026-114097","body":"## Overview\n\nDulwich from 0.23.1 before 1.2.8 contains a path traversal vulnerability in CommitFilter._apply_index_filter() that allows attackers to write files outside the working directory via symlinks persisting between commits. Attackers can craft a repository where an ancestor commit's symlink redirects a descendant commit's file writes during filter_branch, enabling code execution by writing into .git/hooks.\n\n## Affected\n\n- `dulwich >= 0.23.1 < 1.2.8`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-114097)\n\nAffected packages:\n\n- `dulwich >= 0.23.1, < 1.2.8`\n\nPatched in:\n\n- `dulwich 1.2.8`\n\nSource: https://osv.dev/vulnerability/GHSA-5fqc-mrg8-w798","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":227788,"id":"CVE-2026-114097","ts":1792706625219,"field":"cvss","old":"8.6","new":"7.8"},{"seq":226978,"id":"CVE-2026-114097","ts":1792583690262,"field":"cvss","old":"7.8","new":"8.6"}]}