CVE-2026-114094 jelmer CVE debrief

Who should care

Defenders responsible for maintaining and securing systems that use Dulwich on Windows should assess their exposure and take necessary actions. This includes verifying the presence of Dulwich, reviewing configurations, and ensuring systems are updated to prevent potential path traversal attacks. Additionally, defenders should monitor for suspicious activity that may indicate exploitation of the vulnerability and implement compensating controls for exposed

Why it matters

A High-severity Path Traversal vulnerability exists in Dulwich's checkout logic when running on Windows, allowing for arbitrary file writes.

• Verify and update Dulwich to version 1.2.9 or later to prevent potential path traversal attacks
• Review systems for potential exposure to ensure that Dulwich is properly configured and secured
• Monitor for suspicious activity that may indicate exploitation of the vulnerability

Technical summary

The functions responsible for validating NTFS paths in Dulwich strictly reject `.git` variants, Alternate Data Streams (ADS), `git~1` short names, and reserved device names, but they completely fail to check for **DOS drive letter prefixes**. This oversight allows a malicious Git tree to potentially write files to arbitrary locations outside of the intended Git worktree by exploiting the way Windows handles drive letters in path joins. The issue arises from Dulwich's use of `os.path.join` with a path that may contain an absolute drive letter, leading to the root path being discarded. Defenders should prioritize verifying and updating Dulwich to version 1.2.9 or later, and review their systems for potential

Defensive priority

Defenders should prioritize verifying and updating Dulwich to version 1.2.9 or later, and review their systems for potential exposure.

Recommended defensive actions

• Verify and update Dulwich to version 1.2.9 or later
• Review systems for potential exposure
• Monitor for suspicious activity
• Perform a thorough review of system configurations and Git tree handling
• Implement compensating controls for exposed systems
• Track exceptions and retest remediated assets
• technicalSummary

Evidence notes

The vulnerability is caused by the lack of validation for DOS drive letter prefixes in Dulwich's checkout logic on Windows. This oversight allows a malicious Git tree to potentially write files to arbitrary locations outside of the intended Git worktree by exploiting the way Windows handles drive letters in path joins. Defenders should verify the presence of Dulwich on Windows systems, review configuration, and ensure systems are updated to a version that addresses this issue. Evidence is based on public CVE details and affected file:

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.