CVE-2026-114097

Name of the Vulnerable Software and Affected Versions Dulwich versions 0.23.1 through 1.2.7

Description A path traversal issue exists in the CommitFilter. apply index filter() function within filter branch.py. The problem occurs because materialized tree entries, including symlinks, persist in the working directory between commit iterations. An attacker can craft a malicious repository where a symlink in an ancestor commit redirects file writes from a descendant commit to arbitrary locations on the filesystem. This can lead to remote code execution if an attacker writes malicious content into the .git/hooks directory.

Recommendations Update Dulwich to version 1.2.8 or later. As a temporary workaround, avoid running filter branch with an index filter on repositories from untrusted sources.