CVE-2026-114096

Dulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in porcelain.checkoutpaths=... that allows attackers to write arbitrary files by abusing raw os.open without ONOFOLLOW. Attackers can craft a repository where a worktree symlink points to .git/hooks/post-checkout, so...

CVE-2026-114096 Dulwich 0.24.0 before 1.2.8 Symlink Write-Through via porcelain.checkout paths

Dulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in porcelain.checkoutpaths=... that allows attackers to write arbitrary files by abusing raw os.open without ONOFOLLOW. Attackers can craft a repository where a worktree symlink points to .git/hooks/post-checkout, so...

CVE-2026-114094 Dulwich before 1.2.9 Arbitrary File Write via DOS drive letter paths

Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrary file write. Attackers can craft a malicious repository with a tree entry named 'C:' that bypasses NTFS validation and writes files outside the worktree to achieve remote code...

CVE-2026-114094

Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrary file write. Attackers can craft a malicious repository with a tree entry named 'C:' that bypasses NTFS validation and writes files outside the worktree to achieve remote code...

CVE-2026-114094 Dulwich before 1.2.9 Arbitrary File Write via DOS drive letter paths

Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrary file write. Attackers can craft a malicious repository with a tree entry named 'C:' that bypasses NTFS validation and writes files outside the worktree to achieve remote code...

CVE-2026-114094

Versions of Dulwich before 1.2.9 are vulnerable to an arbitrary file write on Windows due to a failure to validate DOS drive letter prefixes in Git tree path elements. An attacker can craft a malicious repository containing a tree entry named 'C:' , which bypasses NTFS validation . This allows th...

CVE-2026-114094 Dulwich before 1.2.9 Arbitrary File Write via DOS drive letter paths

Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrary file write. Attackers can craft a malicious repository with a tree entry named 'C:' that bypasses NTFS validation and writes files outside the worktree to achieve remote code...

EUVD-2026-106897

Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrary file write. Attackers can craft a malicious repository with a tree entry named 'C:' that bypasses NTFS validation and writes files outside the worktree to achieve remote code...

CVE-2026-114094

Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrary file write. Attackers can craft a malicious repository with a tree entry named 'C:' that bypasses NTFS validation and writes files outside the worktree to achieve remote code...

CVE-2026-114063 SvelteKit 2.10.0 before 3.0.0 Path Traversal via vite preview on Windows

SvelteKit @sveltejs/kit from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on Windows that allows unauthenticated attackers to read files outside the prerendered output directory. Attackers who can reach the preview server through network access or a tunne...

CVE-2026-114063

SvelteKit @sveltejs/kit from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on Windows that allows unauthenticated attackers to read files outside the prerendered output directory. Attackers who can reach the preview server through network access or a tunne...

CVE-2026-114063

SvelteKit (@sveltejs/kit) versions 2.10.0 before 3.0.0 are vulnerable to a path traversal vulnerability within the vite preview server on Windows systems. This flaw allows unauthenticated attackers with network access or a tunnel to the preview server to send crafted requests and read files outsi...

EUVD-2026-107014

SvelteKit @sveltejs/kit from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on Windows that allows unauthenticated attackers to read files outside the prerendered output directory. Attackers who can reach the preview server through network access or a tunne...

CVE-2025-71437 Astral uv through 0.8.21 Path Traversal via Symlinks in Sdist Tar Extraction

Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution sdist tar extraction that allows a specially crafted sequence of symlinks to redirect file writes outside the intended extraction prefix. Attackers can publish a malicious sdist that, when installed by a victim...

CVE-2025-71437

Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution sdist tar extraction that allows a specially crafted sequence of symlinks to redirect file writes outside the intended extraction prefix. Attackers can publish a malicious sdist that, when installed by a victim...

CVE-2025-71437 Astral uv through 0.8.21 Path Traversal via Symlinks in Sdist Tar Extraction

Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution sdist tar extraction that allows a specially crafted sequence of symlinks to redirect file writes outside the intended extraction prefix. Attackers can publish a malicious sdist that, when installed by a victim...

EUVD-2025-211142

Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution sdist tar extraction that allows a specially crafted sequence of symlinks to redirect file writes outside the intended extraction prefix. Attackers can publish a malicious sdist that, when installed by a victim...

CVE-2025-71437

Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution sdist tar extraction that allows a specially crafted sequence of symlinks to redirect file writes outside the intended extraction prefix. Attackers can publish a malicious sdist that, when installed by a victim...

CVE-2025-71437

The Astral uv package version 0.8.21 and earlier is vulnerable to a path traversal vulnerability during the extraction of source distribution (sdist) tar files. The root cause is a flaw where a specially crafted sequence of symlinks can be used to redirect file writes outside of the intended extr...

CVE-2025-71437 Astral uv through 0.8.21 Path Traversal via Symlinks in Sdist Tar Extraction

Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution sdist tar extraction that allows a specially crafted sequence of symlinks to redirect file writes outside the intended extraction prefix. Attackers can publish a malicious sdist that, when installed by a victim...