Vulnerability · Published Oct 21, 2026 · Assigned by VulnCheck
CVE-2026-114094Dulwich before 1.2.9 Arbitrary File Write via DOS drive letter paths
High 8.8
In plain English
A high-severity path traversal in dulwich from jelmer. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 61% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.9%top 38.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrary file write. Attackers can craft a malicious repository with a tree entry named 'C:' that bypasses NTFS validation and writes files outside the worktree to achieve remote code execution.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | dulwich | 1.2.9 | GHSA-8mcx-5rqc-vhmf |
| Ubuntu:22.04:LTS | dulwich | no fix listed | UBUNTU-CVE-2026-114094 |
| Ubuntu:24.04:LTS | dulwich | no fix listed | UBUNTU-CVE-2026-114094 |
| Ubuntu:26.04:LTS | dulwich | no fix listed | UBUNTU-CVE-2026-114094 |
| Ubuntu:26.10 | dulwich | no fix listed | UBUNTU-CVE-2026-114094 |
Affected products (as reported)
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- GitHub Security Advisory (GHSA-8mcx-5rqc-vhmf) vendor-advisory
- VulnCheck Advisory: Dulwich before 1.2.9 Arbitrary File Write via DOS drive letter paths third-party-advisory