{"id":"CVE-2026-114096","title":"Dulwich 0.24.0 before 1.2.8 Symlink Write-Through via porcelain.checkout paths","summary":"Dulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in porcelain.checkout(paths=[...]) that allows attackers to write arbitrary files by abusing raw os.open without O_NOFOLLOW. Attackers can craft a repository whe…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-59"],"vendor":"jelmer","product":"dulwich","affected":["dulwich >= 0.24.0 < 1.2.8"],"published":"2026-10-21","updated":"2026-10-21","sourceUpdated":"2026-10-21T00:36:59.763Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-114096","references":[{"url":"https://github.com/jelmer/dulwich/security/advisories/GHSA-8w8g-wq8h-fq33","label":"GitHub Security Advisory (GHSA-8w8g-wq8h-fq33)"},{"url":"https://www.vulncheck.com/advisories/dulwich-0.24.0-before-1.2.8-symlink-write-through-via-porcelain-checkout-paths","label":"VulnCheck Advisory: Dulwich 0.24.0 before 1.2.8 Symlink Write-Through via porcelain.checkout paths"}],"tags":["cve.org"],"ingestedAt":"2026-10-21T01:37:08.017Z","slug":"CVE-2026-114096","body":"## Overview\n\nDulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in porcelain.checkout(paths=[...]) that allows attackers to write arbitrary files by abusing raw os.open without O_NOFOLLOW. Attackers can craft a repository where a worktree symlink points to .git/hooks/post-checkout, so restoring the file from a tag writes a malicious hook for code execution.\n\n## Affected\n\n- `dulwich >= 0.24.0 < 1.2.8`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}