EUVD-2026-106899

Dulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in porcelain.checkoutpaths=... that allows attackers to write arbitrary files by abusing raw os.open without ONOFOLLOW. Attackers can craft a repository where a worktree symlink points to .git/hooks/post-checkout, so...

Dulwich: Symlink write-through in checkout(paths=[]) via raw os.open bypasses all symlink protections

Summary Dulwich's porcelain.checkoutpaths=... code path writes files using raw os.openfilepath, OWRONLY|OCREAT|OTRUNC, mode followed by f.writeobj.data. This code path does NOT call buildfilefromblob at all, completely bypassing any symlink protections including the unreleased d09f8af fix. os.ope...

GHSA-8W8G-WQ8H-FQ33 Dulwich: Symlink write-through in checkout(paths=[]) via raw os.open bypasses all symlink protections

Summary Dulwich's porcelain.checkoutpaths=... code path writes files using raw os.openfilepath, OWRONLY|OCREAT|OTRUNC, mode followed by f.writeobj.data. This code path does NOT call buildfilefromblob at all, completely bypassing any symlink protections including the unreleased d09f8af fix. os.ope...