CVE-2026-114098 jelmer CVE debrief

Who should care

Git users who use Dulwich, specifically those who clone and work with repositories from untrusted sources, should be aware of this vulnerability and take steps to protect themselves.

Why it matters

This vulnerability allows an attacker to write arbitrary files outside the repository worktree when a victim pops a stash in a malicious repository, potentially leading to Remote Code Execution.

• Remote Code Execution on the victim's machine on the next git checkout operation
• Writing to arbitrary filesystem locations
• Potential data loss or corruption

Technical summary

The `pop()` function in Dulwich's `stash.py` is vulnerable to symlink directory traversal. An attacker can craft a malicious repository that, when a victim clones it and performs a stash pop operation, writes attacker-controlled content to arbitrary filesystem locations. The vulnerability arises from the function's use of `os.path.exists(parent_dir)` to check if a parent directory exists before writing stashed files, which follows symlinks and allows an attacker to write files outside the repository worktree via intermediate directory symlinks.

Defensive priority

High

Recommended defensive actions

• Update Dulwich to version 1.2.8 or later
• Restrict access to sensitive repositories
• Monitor for suspicious repository activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability exists in Dulwich's `stash.py:pop()` function, which uses `os.path.exists(parent_dir)` to check if a parent directory exists before writing stashed files. However, `os.path.exists()` follows symlinks, allowing an attacker to write arbitrary files outside the repository worktree.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.