CVE-2026-47712: Dulwich doesn't sanitize commit subjects in `porcelain.format_patch`
Impact
dulwich.porcelain.formatpatch(outdir=...) derives each patch filename from the commit's subject line. Prior to this fix, getsummary only replaced spaces with dashes - path separators (/, \), parent-directory components (..), and other filename-hostile characters (e.g. :) were preserved verbatim and passed straight into os.path.join(outdir, f"{i:04d}-{summary}.patch").
A malicious commit subject could therefore direct the generated patch file outside the requested outdir. Reduced examples:
- x/../../x produced <outdir>/0001-x/../../x.patch, resolving two directories above outdir. - x\..\..\x produced the equivalent escape on Windows, here \ is also a path separator.
Related issues from the same root cause:
- Subjects containing characters that are illegal in Windows filenames (e.g. :) caused formatpatch to fail outright on Windows, where git would have succeeded. - Very long subjects produced excessively long filenames that could exceed filesystem limits; git truncates them.
Anyone calling porcelain.formatpatch (or the dulwich format-patch CLI) against untrusted commits - for example, a service that runs format-patch over user-supplied repositories or pull requests - could have patch files written to attacker-chosen locations within the process's write permissions.
Patches
Fixed in Dulwich 1.2.5. Users should upgrade.
dulwich.patch.getsummary now mirrors git's formatsanitizedsubject: only [A-Za-z0-9.] are kept, runs of other characters collapse to a single -, consecutive . collapse to a single ., trailing ./- are stripped, and the result is length-limited. This makes the returned string safe to embed as a filename component, so formatpatch can no longer be steered out of outdir via the commit subject.
Workarounds
Until upgrading, callers that pass untrusted commits to porcelain.formatpatch can:
- Use stdout=True and write the patch to a destination they control, rather than letting formatpatch choose the filename. - Validate the chosen path before opening - e.g. compare os.path.realpath(returnedpath) against os.path.realpath(outdir) and reject any patch whose resolved path is not inside outdir. - Pre-screen commits and refuse to format any whose subject's first line contains /, \, .., or other characters that are not safe on the target filesystem.
Resources
- Fix commit: https://github.com/jelmer/dulwich/commit/c2446e51b - Affected API: dulwich.porcelain.formatpatch / dulwich format-patch - Reference behavior: git's formatsanitizedsubject in pretty.c
Other sources
Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.24.0 and prior to version 1.2.5, dulwich.porcelain.formatpatch(outdir=...) derives each patch filename from the commit's subject line. Prior to this fix, getsummary only replaced spaces with dashes - path separators (/, \), parent-directory components (..), and other filename-hostile characters (e.g. :) were preserved verbatim and passed straight into os.path.join(outdir, f"{i:04d}-{summary}.patch"). A malicious commit subject could therefore direct the generated patch file outside the requested outdir. This is fixed in Dulwich 1.2.5. Users should upgrade to 1.2.5 or later. dulwich.patch.getsummary now mirrors git's formatsanitizedsubject: only [A-Za-z0-9.] are kept, runs of other characters collapse to a single -, consecutive . collapse to a single ., trailing ./- are stripped, and the result is length-limited. This makes the returned string safe to embed as a filename component, so formatpatch can no longer be steered out of outdir via the commit subject. Until upgrading, callers that pass untrusted commits to porcelain.formatpatch can use stdout=True and write the patch to a destination they control, rather than letting formatpatch choose the filename; validate the chosen path before opening - e.g. compare os.path.realpath(returnedpath) against os.path.realpath(outdir) and reject any patch whose resolved path is not inside outdir; and/or pre-screen commits and refuse to format any whose subject's first line contains /, \, .., or other characters that are not safe on the target filesystem.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/dulwichto a version that resolves this vulnerability.Fixed in 1.2.5 - Upgrade
Upgrade
dulwichto a version that resolves this vulnerability.Fixed in 1.2.5 - Configuration
Until upgrading to Dulwich 1.2.5 or later, call porcelain.format_patch with stdout=True and write the patch to a destination they control, rather than letting format_patch choose the filename.
dulwich.porcelain.format_patch (or dulwich format-patch CLI) stdout = True - Compensating control
Until upgrading, validate the chosen path before opening: compare os.path.realpath(returned_path) against os.path.realpath(outdir) and reject any patch whose resolved path is not inside outdir.
- Compensating control
Until upgrading, pre-screen commits and refuse to format any whose subject's first line contains /, \, .., or other characters that are not safe on the target filesystem.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-47712?
The severity of CVE-2026-47712 is classified as low with a score of 3.3.
What impact does CVE-2026-47712 have?
CVE-2026-47712 can lead to path traversal vulnerabilities due to filename-hostile characters being preserved in patch filenames.
How do I fix CVE-2026-47712?
To fix CVE-2026-47712, update to the latest version of dulwich that implements proper filename sanitization.
Which software is affected by CVE-2026-47712?
CVE-2026-47712 affects the pip/dulwich software.
What type of vulnerability is CVE-2026-47712?
CVE-2026-47712 is categorized as a Path Traversal vulnerability.