CVE-2026-114098

Dulwich versions 0.22.5 through 1.2.8 (prior to 1.2.8) are vulnerable to a path traversal vulnerability within the stash.py pop() function. This flaw allows an attacker to write arbitrary files outside the worktree by utilizing intermediate directory symlinks. A practical impact includes an attac...

EUVD-2026-106901

Dulwich from 0.22.5 before 1.2.8 contains a path traversal vulnerability in stash.py pop that allows attackers to write arbitrary files outside the worktree through intermediate directory symlinks. Attackers can craft a malicious repository whose popped stash writes a payload into...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack via verifyleadingdirs absent in affected versions in dulwich/stash.py during stash.pop. The old path-existence check used os.path.exists, which follows symlinks, so a stash entry whose parent path component is a symlink...