{"id":"CVE-2026-114098","title":"Dulwich 0.22.5 before 1.2.8 Path Traversal via Stash Pop Symlinks","summary":"Dulwich from 0.22.5 before 1.2.8 contains a path traversal vulnerability in stash.py pop() that allows attackers to write arbitrary files outside the worktree through intermediate directory symlinks. Attackers can craft a malicious repos…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-22"],"vendor":"jelmer","product":"dulwich","affected":["dulwich >= 0.22.5 < 1.2.8"],"published":"2026-10-21","updated":"2026-10-21","sourceUpdated":"2026-10-21T00:37:01.150Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-114098","references":[{"url":"https://github.com/jelmer/dulwich/security/advisories/GHSA-cm62-gvxx-vmxx","label":"GitHub Security Advisory (GHSA-cm62-gvxx-vmxx)"},{"url":"https://www.vulncheck.com/advisories/dulwich-0.22.5-before-1.2.8-path-traversal-via-stash-pop-symlinks","label":"VulnCheck Advisory: Dulwich 0.22.5 before 1.2.8 Path Traversal via Stash Pop Symlinks"}],"tags":["cve.org"],"ingestedAt":"2026-10-21T01:37:08.016Z","slug":"CVE-2026-114098","body":"## Overview\n\nDulwich from 0.22.5 before 1.2.8 contains a path traversal vulnerability in stash.py pop() that allows attackers to write arbitrary files outside the worktree through intermediate directory symlinks. Attackers can craft a malicious repository whose popped stash writes a payload into .git/hooks/post-checkout, achieving code execution on the next checkout.\n\n## Affected\n\n- `dulwich >= 0.22.5 < 1.2.8`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}