Dulwich has an arbitrary file write via NTFS-hostile tree entries on Windows

🗓️ 28 May 2026 22:28:06Reported by GitHub Advisory DatabaseType

Dulwich on Windows allows arbitrary file write via NTFS-hostile tree entries during clone.

Reporter	Title	Published	Views	Family All 150
IBM Security Bulletins	Security Bulletin: Action required for WebSphere Message Broker Hypervisor Edition V8.0 for security vulnerabilities in Red Hat Linux	9 Jan 202010:32	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Integration Bus Hyper visor Edition V9.0 require customer action for security vulnerabilities in Red Hat Linux	20 Dec 201908:47	–	ibm
ALT Linux	Security fix for the ALT Linux 8 package git version 2.24.1-alt1	12 Dec 201900:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 10 package git version 2.24.1-alt1	8 Dec 201900:00	–	altlinux
Tenable Nessus	Amazon Linux 2 : git (ALAS-2019-1371)	19 Dec 201900:00	–	nessus
Tenable Nessus	Amazon Linux 2 : git (ALAS-2023-1943)	23 Feb 202300:00	–	nessus
Tenable Nessus	Amazon Linux 2 : git (ALAS-2025-2818)	17 Apr 202500:00	–	nessus
Tenable Nessus	Amazon Linux AMI : git (ALAS-2019-1325)	13 Dec 201900:00	–	nessus
Tenable Nessus	Alibaba Cloud Linux 3 : 0109: git (ALINUX3-SA-2022:0109)	14 May 202500:00	–	nessus
Tenable Nessus	Debian DLA-2059-1 : git security update	24 Jan 202000:00	–	nessus

Vulners

Node

dulwich_project dulwichRange0.10.0–1.2.5pip

Source	Link
github	www.github.com/jelmer/dulwich/security/advisories/GHSA-897w-fcg9-f6xj
github	www.github.com/jelmer/dulwich/releases/tag/dulwich-1.2.5
github	www.github.com/advisories/GHSA-897w-fcg9-f6xj

28 May 2026 22:28Current

7.8High risk

Vulners AI Score7.8

CVSS 29.3

CVSS 3.19.8

EPSS0.19687