14116 matches found
Dulwich: Arbitrary File Write (RCE) On Windows Via Unvalidated Drive Letters In Tree Paths
Affected files "dulwich/index.py" Methods: "validatepathelementntfs", "treetofspath" "dulwich/porcelain/init.py" Method: "checkedworktreepath" Description / Summary A High-severity Path Traversal vulnerability exists in Dulwich's checkout logic when running on Windows. The functions responsible f...
Exploit for CVE-2026-109618
php2shell-check !statushttps://img.shields.io/badge/status...
Dulwich: Symlink Directory Traversal In Filter-branch Index_filter Via Cross-commit State Persistence
Summary Dulwich's "filterbranch.py" "CommitFilter.applyindexfilter" is vulnerable to symlink directory traversal. When processing commit history, materialized tree entries including symlinks persist in the working directory between commits, allowing a symlink from an ancestor commit to redirect...
Directory Traversal
Overview uv is an An extremely fast Python package and project manager, written in Rust. Affected versions of this package are vulnerable to Directory Traversal via a symlink sequence during source distribution sdist tar extraction. When a victim installs a malicious sdist, a crafted sequence of...
DEBIAN-CVE-2026-114097
Dulwich from 0.23.1 before 1.2.8 contains a path traversal vulnerability in CommitFilter.applyindexfilter that allows attackers to write files outside the working directory via symlinks persisting between commits. Attackers can craft a repository where an ancestor commit's symlink redirects a...
DEBIAN-CVE-2026-114096
Dulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in porcelain.checkoutpaths=... that allows attackers to write arbitrary files by abusing raw os.open without ONOFOLLOW. Attackers can craft a repository where a worktree symlink points to .git/hooks/post-checkout, so...
CVE-2026-114094
Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrary file write. Attackers can craft a malicious repository with a tree entry named 'C:' that bypasses NTFS validation and writes files outside the worktree to achieve remote code...
CVE-2026-114096
Dulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in porcelain.checkoutpaths=... that allows attackers to write arbitrary files by abusing raw os.open without ONOFOLLOW. Attackers can craft a repository where a worktree symlink points to .git/hooks/post-checkout, so...
CVE-2025-71437
Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution sdist tar extraction that allows a specially crafted sequence of symlinks to redirect file writes outside the intended extraction prefix. Attackers can publish a malicious sdist that, when installed by a victim...
CVE-2026-114109 uv before 0.11.15 Arbitrary File Write via Entry Point Names
uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the scripts directory via crafted consolescripts or guiscripts entry point names. Attackers who induce users to install a malicious wheel can place executables in PATH directories,...
CVE-2026-114109 uv before 0.11.15 Arbitrary File Write via Entry Point Names
uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the scripts directory via crafted consolescripts or guiscripts entry point names. Attackers who induce users to install a malicious wheel can place executables in PATH directories,...
CVE-2026-114109
The uv package version before 0.11.15 is vulnerable to a path traversal vulnerability (CWE-22). Malicious wheels can exploit this by using crafted console_scripts or gui_scripts entry point names to write files outside the intended scripts directory. If an attacker successfully induces a user to ...
CVE-2026-114096 Dulwich 0.24.0 before 1.2.8 Symlink Write-Through via porcelain.checkout paths
Dulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in porcelain.checkoutpaths=... that allows attackers to write arbitrary files by abusing raw os.open without ONOFOLLOW. Attackers can craft a repository where a worktree symlink points to .git/hooks/post-checkout, so...
CVE-2026-114096 Dulwich 0.24.0 before 1.2.8 Symlink Write-Through via porcelain.checkout paths
Dulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in porcelain.checkoutpaths=... that allows attackers to write arbitrary files by abusing raw os.open without ONOFOLLOW. Attackers can craft a repository where a worktree symlink points to .git/hooks/post-checkout, so...
CVE-2026-114096
Dulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in porcelain.checkoutpaths=... that allows attackers to write arbitrary files by abusing raw os.open without ONOFOLLOW. Attackers can craft a repository where a worktree symlink points to .git/hooks/post-checkout, so...
EUVD-2026-106899
Dulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in porcelain.checkoutpaths=... that allows attackers to write arbitrary files by abusing raw os.open without ONOFOLLOW. Attackers can craft a repository where a worktree symlink points to .git/hooks/post-checkout, so...
CVE-2026-114096
The Dulwich library (versions 0.24.0 through 1.2.8) is vulnerable to a symlink following issue within the porcelain.checkout(paths=[...]) function. The root cause is the use of a raw os.open call without the O_NOFOLLOW flag, which allows an attacker to write arbitrary files by abusing symlinks. S...
CVE-2026-114096
Dulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in porcelain.checkoutpaths=... that allows attackers to write arbitrary files by abusing raw os.open without ONOFOLLOW. Attackers can craft a repository where a worktree symlink points to .git/hooks/post-checkout, so...
CVE-2026-114094 Dulwich before 1.2.9 Arbitrary File Write via DOS drive letter paths
Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrary file write. Attackers can craft a malicious repository with a tree entry named 'C:' that bypasses NTFS validation and writes files outside the worktree to achieve remote code...
EUVD-2026-106897
Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrary file write. Attackers can craft a malicious repository with a tree entry named 'C:' that bypasses NTFS validation and writes files outside the worktree to achieve remote code...