{"id":"CVE-2026-114098","title":"Dulwich 0.22.5 before 1.2.8 Path Traversal via Stash Pop Symlinks","summary":"Dulwich from 0.22.5 before 1.2.8 contains a path traversal vulnerability in stash.py pop() that allows attackers to write arbitrary files outside the worktree through intermediate directory symlinks. Attackers can craft a malicious repos…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-22"],"vendor":"jelmer","product":"dulwich","affected":["dulwich >= 0.22.5 < 1.2.8"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-27T21:53:59.243541Z"},"published":"2026-10-21","updated":"2026-10-27","sourceUpdated":"2026-10-27T21:54:10.359Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-114098","references":[{"url":"https://github.com/jelmer/dulwich/security/advisories/GHSA-cm62-gvxx-vmxx","label":"GitHub Security Advisory (GHSA-cm62-gvxx-vmxx)"},{"url":"https://www.vulncheck.com/advisories/dulwich-0.22.5-before-1.2.8-path-traversal-via-stash-pop-symlinks","label":"VulnCheck Advisory: Dulwich 0.22.5 before 1.2.8 Path Traversal via Stash Pop Symlinks"},{"url":"https://github.com/jelmer/dulwich/commit/40a542cb02f9ac39a9eeac1193472903098698f9"},{"url":"https://github.com/jelmer/dulwich"},{"url":"https://github.com/jelmer/dulwich/releases/tag/dulwich-1.2.8"}],"tags":["cve.org","osv","pip"],"epss":0.00152,"epssPercentile":0.04299,"aliases":["GHSA-cm62-gvxx-vmxx"],"ecosystem":"pip","patched":["dulwich 1.2.8"],"scores":{"cna":7.8,"osv":8.6},"ingestedAt":"2026-10-21T01:37:08.016Z","slug":"CVE-2026-114098","body":"## Overview\n\nDulwich from 0.22.5 before 1.2.8 contains a path traversal vulnerability in stash.py pop() that allows attackers to write arbitrary files outside the worktree through intermediate directory symlinks. Attackers can craft a malicious repository whose popped stash writes a payload into .git/hooks/post-checkout, achieving code execution on the next checkout.\n\n## Affected\n\n- `dulwich >= 0.22.5 < 1.2.8`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-114098)\n\nAffected packages:\n\n- `dulwich >= 0.22.5, < 1.2.8`\n\nPatched in:\n\n- `dulwich 1.2.8`\n\nSource: https://osv.dev/vulnerability/GHSA-cm62-gvxx-vmxx","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":230489,"id":"CVE-2026-114098","ts":1793141978957,"field":"cvss","old":"8.6","new":"7.8"},{"seq":226980,"id":"CVE-2026-114098","ts":1792583697239,"field":"cvss","old":"7.8","new":"8.6"}]}