CVE-2026-114094

Name of the Vulnerable Software and Affected Versions Dulwich versions prior to 1.2.9

Description A path traversal issue exists in the checkout logic when running on Windows. The software fails to validate DOS drive letter prefixes in Git tree path elements, which allows an attacker to craft a malicious repository with a tree entry such as C:. This bypasses NTFS validation and allows files to be written to absolute paths outside the intended worktree, potentially leading to remote code execution. The issue involves the validate path element ntfs() and tree to fs path() functions in dulwich/index.py, as well as the checked worktree path() function in dulwich/porcelain/ init .py.

Recommendations Update to version 1.2.9 or later. As a temporary workaround, restrict the use of the validate path element ntfs() and tree to fs path() functions when processing untrusted repositories on Windows.