CVE-2026-114098: Dulwich 0.22.5 before 1.2.8 Path Traversal via Stash Pop Symlinks
Dulwich from 0.22.5 before 1.2.8 contains a path traversal vulnerability in stash.py pop() that allows attackers to write arbitrary files outside the worktree through intermediate directory symlinks. Attackers can craft a malicious repository whose popped stash writes a payload into .git/hooks/post-checkout, achieving code execution on the next checkout.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of Dulwich versions from 0.22.5 up to, but not including, 1.2.8 are affected when they pop a stash from a malicious repository.
What does an attacker need to exploit the vulnerability?
An attacker needs to craft a malicious repository containing a stash that uses intermediate directory symlinks. Exploitation requires a user to perform the stash pop operation.
What is the impact after a successful exploit?
The stash pop can write files outside the worktree, including a payload at .git/hooks/post-checkout. That hook can execute code on the next checkout.
How can exposure be reduced if an upgrade is not immediately possible?
Do not run stash pop on repositories that are untrusted or attacker-controlled, because the described exploit relies on popping a malicious stash.