All vulnerabilities
CVE-2026-114097GHSA-5fqc-mrg8-w798

Dulwich 0.23.1 before 1.2.8 Symlink Path Traversal via filter_branch Index Filter

jelmer dulwichPyPILibraries & packages
Open in ThreatlineRecord JSON
CVSS
7.3High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.15%Chance of exploitation activity in the next 30 days, higher than 4% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.2.8Fixed versionCVE List
Published21 Oct 2026Updated 22 Oct 2026CVE List

What fixes it

  • 1.2.8dulwichCVE List
  • 1.2.8dulwich, PyPIOSVpip install "dulwich>=1.2.8"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Dulwich from 0.23.1 before 1.2.8 contains a path traversal vulnerability in CommitFilter._apply_index_filter() that allows attackers to write files outside the working directory via symlinks persisting between commits. Attackers can craft a repository where an ancestor commit's symlink redirects a descendant commit's file writes during filter_branch, enabling code execution by writing into .git/hooks.

Text from CVE List

Affected versions 29

  • dulwichaffected: 0.23.1 before 1.2.8CVE List
  • dulwichunaffected: 1.2.8CVE List
  • dulwich, PyPIfrom 0.23.1, fixed in 1.2.8OSV
  • dulwich, PyPI0.23.1OSV
  • dulwich, PyPI0.23.2OSV
  • dulwich, PyPI0.24.0OSV
  • dulwich, PyPI0.24.1OSV
  • dulwich, PyPI0.24.10OSV
  • dulwich, PyPI0.24.2OSV
  • dulwich, PyPI0.24.3OSV
  • dulwich, PyPI0.24.4OSV
  • dulwich, PyPI0.24.5OSV
  • dulwich, PyPI0.24.6OSV
  • dulwich, PyPI0.24.7OSV
  • dulwich, PyPI0.24.8OSV
  • dulwich, PyPI0.24.9OSV
  • dulwich, PyPI0.25.0OSV
  • dulwich, PyPI0.25.1OSV
  • dulwich, PyPI0.25.2OSV
  • dulwich, PyPI1.0.0OSV
  • dulwich, PyPI1.1.0OSV
  • dulwich, PyPI1.2.0OSV
  • dulwich, PyPI1.2.1OSV
  • dulwich, PyPI1.2.2OSV
  • dulwich, PyPI1.2.3OSV
  • dulwich, PyPI1.2.4OSV
  • dulwich, PyPI1.2.5OSV
  • dulwich, PyPI1.2.6OSV
  • dulwich, PyPI1.2.7OSV

References 2