CVE-2026-114096 Dulwich 0.24.0 before 1.2.8 Symlink Write-Through via porcelain.checkout paths
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-114096?
CVE-2026-114096 is a high-severity vulnerability in jelmer dulwich, published on 21 Oct 2026.
Official description
Dulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in porcelain.checkout(paths=[...]) that allows attackers to write arbitrary files by abusing raw os.open without O_NOFOLLOW. Attackers can craft a repository where a worktree symlink points to .git/hooks/post-checkout, so restoring the file from a tag writes a malicious hook for code execution.
Weakness: CWE-59
Which versions are affected by CVE-2026-114096?
2 open source packages ship an affected version, including dulwich.
| Package | Affected | Fixed in |
|---|---|---|
dulwich PyPI | From 0.24.0 | 1.2.8 |
dulwich PyPI | From 0.24.0 | 1.2.8 |
How do I fix CVE-2026-114096?
Upgrade dulwich to 1.2.8 or later.
Is CVE-2026-114096 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-114096 exists.
Sources
Also known as DEBIAN-CVE-2026-114096, ECHO-0ab0-979a-5ca7, GHSA-8w8g-wq8h-fq33, GHSA-8wh8-hpg9-jvx8, MINI-w3jg-42j6-7wpf, MINI-xjfw-pg99-j7hf and 1 more.