{"id":"CVE-2026-114097","title":"Dulwich 0.23.1 before 1.2.8 Symlink Path Traversal via filter_branch Index Filter","summary":"Dulwich from 0.23.1 before 1.2.8 contains a path traversal vulnerability in CommitFilter._apply_index_filter() that allows attackers to write files outside the working directory via symlinks persisting between commits. Attackers can craf…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-22"],"vendor":"jelmer","product":"dulwich","affected":["dulwich >= 0.23.1 < 1.2.8"],"published":"2026-10-21","updated":"2026-10-21","sourceUpdated":"2026-10-21T00:37:00.461Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-114097","references":[{"url":"https://github.com/jelmer/dulwich/security/advisories/GHSA-5fqc-mrg8-w798","label":"GitHub Security Advisory (GHSA-5fqc-mrg8-w798)"},{"url":"https://www.vulncheck.com/advisories/dulwich-0.23.1-before-1.2.8-symlink-path-traversal-via-filter-branch-index-filter","label":"VulnCheck Advisory: Dulwich 0.23.1 before 1.2.8 Symlink Path Traversal via filter_branch Index Filter"}],"tags":["cve.org"],"ingestedAt":"2026-10-21T01:37:08.016Z","slug":"CVE-2026-114097","body":"## Overview\n\nDulwich from 0.23.1 before 1.2.8 contains a path traversal vulnerability in CommitFilter._apply_index_filter() that allows attackers to write files outside the working directory via symlinks persisting between commits. Attackers can craft a repository where an ancestor commit's symlink redirects a descendant commit's file writes during filter_branch, enabling code execution by writing into .git/hooks.\n\n## Affected\n\n- `dulwich >= 0.23.1 < 1.2.8`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}