All vulnerabilities
CVE-2026-114098GHSA-cm62-gvxx-vmxx

Dulwich 0.22.5 before 1.2.8 Path Traversal via Stash Pop Symlinks

jelmer dulwichPyPILibraries & packages
Open in ThreatlineRecord JSON
CVSS
7.3High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.15%Chance of exploitation activity in the next 30 days, higher than 4% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.2.8Fixed versionCVE List
Published21 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

  • 1.2.8dulwichCVE List
  • 1.2.8dulwich, PyPIOSVpip install "dulwich>=1.2.8"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Dulwich from 0.22.5 before 1.2.8 contains a path traversal vulnerability in stash.py pop() that allows attackers to write arbitrary files outside the worktree through intermediate directory symlinks. Attackers can craft a malicious repository whose popped stash writes a payload into .git/hooks/post-checkout, achieving code execution on the next checkout.

Text from CVE List

Affected versions 34

  • dulwichaffected: 0.22.5 before 1.2.8CVE List
  • dulwichunaffected: 1.2.8CVE List
  • dulwich, PyPIfrom 0.22.5, fixed in 1.2.8OSV
  • dulwich, PyPI0.22.5OSV
  • dulwich, PyPI0.22.6OSV
  • dulwich, PyPI0.22.7OSV
  • dulwich, PyPI0.22.8OSV
  • dulwich, PyPI0.23.0OSV
  • dulwich, PyPI0.23.1OSV
  • dulwich, PyPI0.23.2OSV
  • dulwich, PyPI0.24.0OSV
  • dulwich, PyPI0.24.1OSV
  • dulwich, PyPI0.24.10OSV
  • dulwich, PyPI0.24.2OSV
  • dulwich, PyPI0.24.3OSV
  • dulwich, PyPI0.24.4OSV
  • dulwich, PyPI0.24.5OSV
  • dulwich, PyPI0.24.6OSV
  • dulwich, PyPI0.24.7OSV
  • dulwich, PyPI0.24.8OSV
  • dulwich, PyPI0.24.9OSV
  • dulwich, PyPI0.25.0OSV
  • dulwich, PyPI0.25.1OSV
  • dulwich, PyPI0.25.2OSV
  • dulwich, PyPI1.0.0OSV
  • dulwich, PyPI1.1.0OSV
  • dulwich, PyPI1.2.0OSV
  • dulwich, PyPI1.2.1OSV
  • dulwich, PyPI1.2.2OSV
  • dulwich, PyPI1.2.3OSV
  • dulwich, PyPI1.2.4OSV
  • dulwich, PyPI1.2.5OSV
  • dulwich, PyPI1.2.6OSV
  • dulwich, PyPI1.2.7OSV

References 2