CVE-2026-114097: Dulwich 0.23.1 before 1.2.8 Symlink Path Traversal via filter_branch Index Filter
Dulwich from 0.23.1 before 1.2.8 contains a path traversal vulnerability in CommitFilter.applyindexfilter() that allows attackers to write files outside the working directory via symlinks persisting between commits. Attackers can craft a repository where an ancestor commit's symlink redirects a descendant commit's file writes during filterbranch, enabling code execution by writing into .git/hooks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Dulwichto a version that resolves this vulnerability.Fixed in 1.2.8
Event History
Frequently Asked Questions
Who is exposed to this issue?
Installations using Dulwich versions from 0.23.1 up to, but not including, 1.2.8 are affected when they run filter_branch with the vulnerable index-filter path on an attacker-crafted repository.
What does an attacker need to exploit it?
The attacker needs to supply or induce processing of a repository whose ancestor commit contains a symlink and whose descendant commit writes through that symlink. Exploitation also requires a user to run the affected filter_branch operation, consistent with the user-interaction requirement in the severity vector.
What is the practical impact of successful exploitation?
The crafted symlink can redirect writes outside the working directory. The described impact includes writing to .git/hooks, which can lead to code execution.
What should be done if immediate patching is not possible?
Do not run filter_branch with the affected index-filter behavior on untrusted or attacker-supplied repositories. Treat repositories containing symlinks across commit history as unsafe for this operation until Dulwich is updated to 1.2.8 or later.