High severity7.8NVD Advisory· Published Oct 21, 2026· Updated Oct 21, 2026
CVE-2026-114098
CVE-2026-114098
Description
Dulwich from 0.22.5 before 1.2.8 contains a path traversal vulnerability in stash.py pop() that allows attackers to write arbitrary files outside the worktree through intermediate directory symlinks. Attackers can craft a malicious repository whose popped stash writes a payload into .git/hooks/post-checkout, achieving code execution on the next checkout.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <1.2.8, >=0.22.5
Patches
Vulnerability mechanics
References
2News mentions
0No linked articles in our index yet.