CVE-2026-114098 Dulwich 0.22.5 before 1.2.8 Path Traversal via Stash Pop Symlinks
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-114098?
CVE-2026-114098 is a high-severity vulnerability in jelmer dulwich, published on 21 Oct 2026.
Official description
Dulwich from 0.22.5 before 1.2.8 contains a path traversal vulnerability in stash.py pop() that allows attackers to write arbitrary files outside the worktree through intermediate directory symlinks. Attackers can craft a malicious repository whose popped stash writes a payload into .git/hooks/post-checkout, achieving code execution on the next checkout.
Weakness: CWE-22
Which versions are affected by CVE-2026-114098?
2 open source packages ship an affected version, including dulwich.
| Package | Affected | Fixed in |
|---|---|---|
dulwich PyPI | From 0.22.5 | 1.2.8 |
dulwich PyPI | From 0.22.5 | 1.2.8 |
How do I fix CVE-2026-114098?
Upgrade dulwich to 1.2.8 or later.
Is CVE-2026-114098 being exploited?
There is no known exploitation of CVE-2026-114098 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-114098, ECHO-1118-ce02-627c, GHSA-cm62-gvxx-vmxx, GHSA-mw9m-763w-f8m9, MINI-7fjc-q85f-qvfh, MINI-jv3v-7qjw-m5xr and 1 more.