---
id: "CVE-2026-114097"
kind: "vulnerability"
aliases: ["CVE-2026-114097"]
title: "Dulwich: symlink path traversal in filter_branch lets attackers write files"
severity: "high"
cvss: 7.8
epss: 0.00152
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["dulwich", "git-tooling", "package", "python"]
not_affected_if: ["no-filter-branch-usage", "trusted-repositories-only", "version-1.2.8-or-later"]
published_at: "2026-10-21T01:17:35+00:00"
first_seen_at: "2026-10-23T21:57:28+00:00"
updated_at: "2026-10-25T03:08:27+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114097", "first_seen_at": "2026-10-23T21:57:28+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114097", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# Dulwich: symlink path traversal in filter_branch lets attackers write files

Dulwich, a pure-Python Git library, has a path traversal in CommitFilter._apply_index_filter() where a symlink from an ancestor commit redirects a later commit's file writes outside the working directory. An attacker who crafts such a repository can get code executed by writing into .git/hooks.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `pip show dulwich` (or check the lockfile) and see whether the installed version is at least `1.2.8` and below `0.23.1` is out of range.
- Find code that calls `CommitFilter` or `filter_branch` from dulwich on repositories you did not create.

## Fix

- Upgrade dulwich to `1.2.8` or later.
- Until then, do not run history-rewriting filters on untrusted repositories.

## Timeline

- 2026-10-23T21:57:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114097
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114097

## From the sources

Dulwich from 0.23.1 before 1.2.8 contains a path traversal vulnerability in CommitFilter._apply_index_filter() that allows attackers to write files outside the working directory via symlinks persisting between commits. Attackers can craft a repository where an ancestor commit's symlink redirects a descendant commit's file writes during filter_branch, enabling code execution by writing into .git/hooks.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_