Advisory · CVE-2026-114094
Dulwich on Windows can write outside the worktree from a crafted drive-letter tree entry
Dulwich before 1.2.9 does not validate DOS drive letter prefixes in Git tree path elements on Windows, so a malicious repository with a tree entry named like a drive prefix can write files outside the worktree and reach code execution. CVSS 3.1 8.8.
- Vendor
- Dulwich
- Product
- Dulwich
- Identifier / CWE
- CVE-2026-114094
CWE-22 - Action timing
- Immediate
Explain it like I’m five
A rigged repository can name a file with a drive letter at the front, and Dulwich on Windows follows that name out of the project folder instead of keeping the checkout inside it.
- 01Crafted repository created
An attacker creates a repository containing a tree entry named with a DOS drive letter prefix, such as a drive root entry.
- 02Victim checks it out on Windows
A user or automated job clones or checks out the repository using Dulwich on Windows.
- 03Prefix not validated
Dulwich fails to validate the drive letter prefix in the tree path element, bypassing its NTFS path validation.
- 04File written outside the worktree
Checkout writes a file outside the intended working tree at the attacker-chosen location.
- 05Code execution follows
Per the advisory record, placing an executable or script where it will later run turns the file write into code execution.
What happened
The Dulwich project disclosed CVE-2026-114094: Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrary file write. An attacker can craft a malicious repository with a tree entry named as a drive prefix that bypasses NTFS validation and writes files outside the worktree, achieving remote code execution when the written file is placed or invoked as an executable. The CVSS 3.1 score is 8.8, with network attack vector, low complexity, no privileges, and user interaction required.
Per the affected data in the NVD record, versions before 1.2.9 are affected and 1.2.9 is listed as unaffected, so upgrading to Dulwich 1.2.9 or later is the stated fix. The record scopes the flaw to Windows path handling.
What to do
- Inventory Dulwich installations and tools that embed it, especially on Windows workstations, CI runners, and automation that clones untrusted repositories.
- Upgrade affected installations to Dulwich 1.2.9 or later using the project release guidance.
- Avoid cloning or checking out untrusted repositories with Dulwich on Windows until the upgrade lands, and keep repository automation in sandboxes with no write access outside the workspace.
- Hunt for checkouts that wrote files outside workspace roots, unexpected executables in PATH directories, and repositories containing drive-letter tree entries.
- Verify the deployed version after updating, including copies vendored inside other tools.
Management note
Dulwich is plumbing inside other developer tools, so it is easy to miss in an inventory. Any Windows automation that checks out outside code with it should be patched first, because the malicious input is just a repository.