CERT24CVE-2026-114094 — Dulwich before 1.2.9: arbitrary file write via DOS drive-letter pathsLoading data…
CERT24Threat Observatory
Period

CVE-2026-114094 — Dulwich before 1.2.9: arbitrary file write via DOS drive-letter paths

Dulwich versions before 1.2.9 fail to properly validate DOS drive-letter prefixes in Git tree path elements on Windows. A malicious repository may therefore be able to write files outside the worktree.

← Back to intelligence

CVE-2026-114094 — Dulwich before 1.2.9: arbitrary file write via DOS drive-letter paths

Dulwich versions before 1.2.9 fail to properly validate DOS drive-letter prefixes in Git tree path elements on Windows. A malicious repository may therefore be able to write files outside the worktree.