{"id":"CVE-2026-114097","kind":"vulnerability","aliases":["CVE-2026-114097"],"related":[],"title":"Dulwich: symlink path traversal in filter_branch lets attackers write files","description":"Dulwich from 0.23.1 before 1.2.8 contains a path traversal vulnerability in CommitFilter._apply_index_filter() that allows attackers to write files outside the working directory via symlinks persisting between commits. Attackers can craft a repository where an ancestor commit's symlink redirects a descendant commit's file writes during filter_branch, enabling code execution by writing into .git/hooks.","summary":"Dulwich, a pure-Python Git library, has a path traversal in CommitFilter._apply_index_filter() where a symlink from an ancestor commit redirects a later commit's file writes outside the working directory. An attacker who crafts such a repository can get code executed by writing into .git/hooks.","severity":"high","cvss":7.8,"epss":0.00152,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dulwich","git-tooling","package","python"],"not_affected_if":["no-filter-branch-usage","trusted-repositories-only","version-1.2.8-or-later"],"how_to_check":"- Run `pip show dulwich` (or check the lockfile) and see whether the installed version is at least `1.2.8` and below `0.23.1` is out of range.\n- Find code that calls `CommitFilter` or `filter_branch` from dulwich on repositories you did not create.","fix":"- Upgrade dulwich to `1.2.8` or later.\n- Until then, do not run history-rewriting filters on untrusted repositories.","status":"open","published_at":"2026-10-21T01:17:35+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T03:08:27+00:00","updated_at":"2026-10-25T03:08:27+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:08:27Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade dulwich to `1.2.8` or later.\n- Until then, do not run history-rewriting filters on untrusted repositories.","reach":"unknown","title":"Dulwich: symlink path traversal in filter_branch lets attackers write files","impact":"high","summary":"Dulwich, a pure-Python Git library, has a path traversal in CommitFilter._apply_index_filter() where a symlink from an ancestor commit redirects a later commit's file writes outside the working directory. An attacker who crafts such a repository can get code executed by writing into .git/hooks.","category":"package","nicknames":[],"who_cares":["python","dulwich","git-tooling"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Attacker writes into .git/hooks and gets code run on the server","analyst_note":"Check the dulwich advisory or changelog for 1.2.8 to confirm the fixed version and whether the attack needs a user to run filter_branch on an untrusted repository.","how_to_check":"- Run `pip show dulwich` (or check the lockfile) and see whether the installed version is at least `1.2.8` and below `0.23.1` is out of range.\n- Find code that calls `CommitFilter` or `filter_branch` from dulwich on repositories you did not create.","needs_analyst":true,"not_affected_if":["version-1.2.8-or-later","no-filter-branch-usage","trusted-repositories-only"],"who_is_affected":"Only projects that use dulwich from 0.23.1 up to but not including 1.2.8 are exposed, and only when they run CommitFilter or filter_branch over repositories that may come from outside. Services that just read or write their own commits with dulwich are less exposed. Teams not using dulwich, or already on 1.2.8, can skip it.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000669,"input_tokens":3405,"output_tokens":657,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-114097':14A,17A '-2026':13A,16A '0.23.1':72C '1.2.8':74C 'allow':83C 'ancestor':42B,104C 'attack':9A,56B,84C,97C 'branch':7A,117C 'code':64B,119C 'commit':43B,47B,96C,105C,111C 'commitfilter._apply_index_filter':36B,81C 'contain':75C 'craft':58B,99C 'cve':12A,15A 'descend':110C 'directori':54B,91C 'dulwich':1A,18B,24B,70C 'enabl':118C 'execut':65B,120C 'file':11A,49B,87C,113C 'filter':6A,116C 'get':63B 'git':20B,29B 'git-tool':19B 'git/hooks':69B,124C 'later':46B 'let':8A 'librari':30B 'outsid':51B,88C 'packag':22B 'path':3A,33B,77C 'persist':94C 'pure':27B 'pure-python':26B 'python':23B,28B 'redirect':44B,108C 'repositori':61B,101C 'symlink':2A,39B,93C,107C 'tool':21B 'travers':4A,34B,78C 'via':92C 'vulner':79C 'work':53B,90C 'write':10A,50B,67B,86C,114C,122C","nicknames":[],"mitigations":[],"who_affected":"Only projects that use dulwich from 0.23.1 up to but not including 1.2.8 are exposed, and only when they run CommitFilter or filter_branch over repositories that may come from outside. Services that just read or write their own commits with dulwich are less exposed. Teams not using dulwich, or already on 1.2.8, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T01:17:35+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114097","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114097","severity":null,"published_at":"2026-10-21T01:17:35+00:00","modified_at":"2026-10-22T16:17:34+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114097","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114097","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}