All vulnerabilities
CVE-2026-114094GHSA-8mcx-5rqc-vhmf

Dulwich before 1.2.9 Arbitrary File Write via DOS drive letter paths

jelmer dulwichPyPILibraries & packages
Open in ThreatlineRecord JSON
CVSS
8.7High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.67%Chance of exploitation activity in the next 30 days, higher than 51% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.2.9Fixed versionCVE List
Published21 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

  • 1.2.9dulwichCVE List
  • 1.2.9dulwich, PyPIOSVpip install "dulwich>=1.2.9"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrary file write. Attackers can craft a malicious repository with a tree entry named 'C:' that bypasses NTFS validation and writes files outside the worktree to achieve remote code execution.

Text from CVE List

Affected versions 53

  • dulwichaffected: all versions before 1.2.9CVE List
  • dulwichunaffected: 1.2.9CVE List
  • dulwich, PyPIfrom first release, fixed in 1.2.9OSV
  • dulwich, PyPI0.0.1OSV
  • dulwich, PyPI0.1.0OSV
  • dulwich, PyPI0.1.1OSV
  • dulwich, PyPI0.10.0OSV
  • dulwich, PyPI0.10.1aOSV
  • dulwich, PyPI0.11.0OSV
  • dulwich, PyPI0.11.1OSV
  • dulwich, PyPI0.11.2OSV
  • dulwich, PyPI0.12.0OSV
  • dulwich, PyPI0.13.0OSV
  • dulwich, PyPI0.14.0OSV
  • dulwich, PyPI0.14.1OSV
  • dulwich, PyPI0.15.0OSV
  • dulwich, PyPI0.16.0OSV
  • dulwich, PyPI0.16.1OSV
  • dulwich, PyPI0.16.2OSV
  • dulwich, PyPI0.16.3OSV
  • dulwich, PyPI0.17.1OSV
  • dulwich, PyPI0.17.2OSV
  • dulwich, PyPI0.17.3OSV
  • dulwich, PyPI0.18.0OSV
  • dulwich, PyPI0.18.1OSV
  • dulwich, PyPI0.18.2OSV
  • dulwich, PyPI0.18.3OSV
  • dulwich, PyPI0.18.4OSV
  • dulwich, PyPI0.18.5OSV
  • dulwich, PyPI0.18.6OSV
  • dulwich, PyPI0.19.0OSV
  • dulwich, PyPI0.19.1OSV
  • dulwich, PyPI0.19.10OSV
  • dulwich, PyPI0.19.11OSV
  • dulwich, PyPI0.19.12OSV
  • dulwich, PyPI0.19.13OSV
  • dulwich, PyPI0.19.14OSV
  • dulwich, PyPI0.19.15OSV
  • dulwich, PyPI0.19.16OSV
  • dulwich, PyPI0.19.2OSV
  • dulwich, PyPI0.19.3OSV
  • dulwich, PyPI0.19.3a0OSV
  • dulwich, PyPI0.19.4OSV
  • dulwich, PyPI0.19.5OSV
  • dulwich, PyPI0.19.6OSV
  • dulwich, PyPI0.19.7OSV
  • dulwich, PyPI0.19.8OSV
  • dulwich, PyPI0.19.9OSV
  • dulwich, PyPI0.2.1OSV
  • dulwich, PyPI0.20.0OSV
  • dulwich, PyPI0.20.1OSV
  • dulwich, PyPI0.20.10OSV
  • dulwich, PyPI0.20.11OSV

References 2