CVE-2026-114094 Dulwich before 1.2.9 Arbitrary File Write via DOS drive letter paths
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-114094?
CVE-2026-114094 is a high-severity vulnerability in jelmer dulwich, published on 21 Oct 2026.
Official description
Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrary file write. Attackers can craft a malicious repository with a tree entry named 'C:' that bypasses NTFS validation and writes files outside the worktree to achieve remote code execution.
Weakness: CWE-22
Which versions are affected by CVE-2026-114094?
2 open source packages ship an affected version, including dulwich.
| Package | Affected | Fixed in |
|---|---|---|
dulwich PyPI | All versions | 1.2.9 |
dulwich PyPI | All versions | 1.2.9 |
How do I fix CVE-2026-114094?
Upgrade dulwich to 1.2.9 or later.
Is CVE-2026-114094 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-114094 exists.
Sources
Also known as AZL-109890, CLSA-2026-1791442146, CLSA-2026-1793014066, ECHO-6327-848d-ed17, GHSA-8mcx-5rqc-vhmf, GHSA-pxf3-54vf-v638 and 3 more.