CVE-2026-114094
Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on…
- Risk score
- 68/100
- CVSS
- 8.8 v3.1
- Exploit chance (30 days)
- 0.7%
- Published
- 21 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrary file write. Attackers can craft a malicious repository to achieve remote code execution.
- Affected
- {'products': ['Dulwich'], 'packages': [], 'versions': ['before 1.2.9']}
- Fix
- Check the linked advisory for the concrete fix
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 8.8 high
- Remotely exploitable without logging in
References
Original description
Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrary file write. Attackers can craft a malicious repository with a tree entry named 'C:' that bypasses NTFS validation and writes files outside the worktree to achieve remote code execution.
Last activity 21 Oct 2026. Patch Forecast updates every hour.