CVE-2026-114098

Name of the Vulnerable Software and Affected Versions Dulwich versions 0.22.5 through 1.2.7

Description A path traversal issue exists in the pop() function within stash.py. The function uses os.path.exists() to verify parent directories, which follows symlinks. If an intermediate directory is a symlink pointing outside the worktree, an attacker can write arbitrary files to the filesystem. For example, a malicious repository can be crafted to write a payload into .git/hooks/post-checkout, leading to remote code execution during the next checkout operation. The validate path() function fails to detect filesystem symlinks, and build file from blob() lacks symlink protection.

Recommendations Update Dulwich to version 1.2.8 or later. As a temporary workaround, avoid performing stash pop operations on repositories from untrusted sources.