High severity8.8NVD Advisory· Published Oct 21, 2026· Updated Oct 21, 2026

CVE-2026-114094

Description

Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrary file write. Attackers can craft a malicious repository with a tree entry named 'C:' that bypasses NTFS validation and writes files outside the worktree to achieve remote code execution.

Affected products

Dulwich Project/Dulwichllm-create
Range: <1.2.9

Patches

Vulnerability mechanics

References

github.com/jelmer/dulwich/security/advisories/GHSA-8mcx-5rqc-vhmfnvd
www.vulncheck.com/advisories/dulwich-before-1.2.9-arbitrary-file-write-via-dos-drive-letter-pathsnvd

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000