CVE-2026-114094: Dulwich before 1.2.9 Arbitrary File Write via DOS drive letter paths
Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrary file write. Attackers can craft a malicious repository with a tree entry named 'C:' that bypasses NTFS validation and writes files outside the worktree to achieve remote code execution.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Dulwichto a version that resolves this vulnerability.Fixed in 1.2.9
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Windows systems using Dulwich versions before 1.2.9 are exposed when they process a malicious repository. The issue relies on DOS drive letter path handling and is not described as affecting other operating systems.
What does an attacker need to exploit it?
An attacker needs to craft a malicious Git repository containing a tree entry named "C:" and persuade a target to process that repository. No authentication or existing privileges are required, but user interaction is required.
What is the recommended remediation?
Upgrade Dulwich to version 1.2.9 or later. If upgrading cannot happen immediately, avoid processing untrusted repositories on affected Windows systems.