CVE-2026-114098

Dulwich versions 0.22.5 through 1.2.8 (prior to 1.2.8) are vulnerable to a path traversal vulnerability within the stash.py pop() function. This flaw allows an attacker to write arbitrary files outside the worktree by utilizing intermediate directory symlinks. A practical impact includes an attac...