CVE-2026-114096— Dulwich 0.24.0 before 1.2.8 Symlink Write-Through via porcelain.checkout paths
Quick assessment
Affected
jelmer dulwich
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Dulwich 0.24.0 至 1.2.8 版本（不含 1.2.8）存在符号链接跟随漏洞，位于 函数中。该漏洞源于在调用 时未使用 标志，导致攻击者可利用此缺陷写入任意文件。攻击者可构造一个仓库，使其工作树中的符号链接指向 ；当从标签恢复该文件时，会写入恶意的钩子脚本，从而实现代码执行。
Possible ATT&CK Techniques 3 AI
T1059.004 · Unix Shell T1204.001 · Malicious Link T1569.002 · Service Execution
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-114096
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Dulwich 0.24.0 before 1.2.8 Symlink Write-Through via porcelain.checkout paths
Source: CVE Program / CVE List V5
Vulnerability Description
Dulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in porcelain.checkout(paths=[...]) that allows attackers to write arbitrary files by abusing raw os.open without O_NOFOLLOW. Attackers can craft a repository where a worktree symlink points to .git/hooks/post-checkout, so restoring the file from a tag writes a malicious hook for code execution.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
在文件访问前对链接解析不恰当(链接跟随)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-114096
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-114096
请登录查看更多情报信息。
Other References for CVE-2026-114096 (2)
Same Patch Batch · jelmer · 2026-10-21 · 5 CVEs total
| CVE-2026-114094 | 8.8 HIGH | Dulwich before 1.2.9 Arbitrary File Write via DOS drive letter paths |
| CVE-2026-114097 | 7.8 HIGH | Dulwich 0.23.1 before 1.2.8 Symlink Path Traversal via filter_branch Index Filter |
| CVE-2026-114098 | 7.8 HIGH | Dulwich 0.22.5 before 1.2.8 Path Traversal via Stash Pop Symlinks |
| CVE-2026-114095 | 6.5 MEDIUM | Dulwich before 1.2.9 Infinite Loop DoS via Pack.resolve_object |
IV. Related Vulnerabilities
Same product: dulwich
-
CVE-2026-114098
Dulwich 0.22.5 before 1.2.8 Path Traversal via Stash Pop Sym -
CVE-2026-114097
Dulwich 0.23.1 before 1.2.8 Symlink Path Traversal via filte -
CVE-2026-114095
Dulwich before 1.2.9 Infinite Loop DoS via Pack.resolve_obje -
CVE-2026-114094
Dulwich before 1.2.9 Arbitrary File Write via DOS drive lett -
CVE-2026-52726
Dulwich's submodule path traversal in porcelain.submodule_up
Same vendor: jelmer
-
CVE-2026-114098
Dulwich 0.22.5 before 1.2.8 Path Traversal via Stash Pop Sym -
CVE-2026-114097
Dulwich 0.23.1 before 1.2.8 Symlink Path Traversal via filte -
CVE-2026-114095
Dulwich before 1.2.9 Infinite Loop DoS via Pack.resolve_obje -
CVE-2026-114094
Dulwich before 1.2.9 Arbitrary File Write via DOS drive lett -
CVE-2026-52726
Dulwich's submodule path traversal in porcelain.submodule_up
Same weakness: CWE-59
-
CVE-2026-113724
virtualenv: Deletion recovery can change a symlink target's -
CVE-2026-113721
virtualenv: Generated files can follow existing destination -
CVE-2026-113716
virtualenv: Builtin creation follows linked environment dire -
CVE-2026-113678
Froxlor before 2.3.15 Symlink Following Privilege Escalation -
CVE-2026-112936
filelock: ReadWriteLock follows a symlink at the lock path i
V. Comments for CVE-2026-114096
No comments yet