RCE Risk: Dulwich Path Traversal Bug Lets Attackers Write Files Outside Directories on Windows
A high-severity path traversal flaw in the Dulwich library enables attackers to write files outside the intended directory on Windows, risking remote code execution.
Key points
- Dulwich versions prior to 1.2.9 are affected by CVE-2026-114094.
- The flaw allows arbitrary file writes via crafted Git tree entries on Windows.
- Attackers can bypass NTFS validation to achieve remote code execution.
The Dulwich Python library contains a high-severity vulnerability that permits arbitrary file writes on Windows systems. This flaw, tracked as CVE-2026-114094, affects all versions of the library before 1.2.9 and enables attackers to execute code remotely by bypassing filesystem protections.
What happened
Dulwich versions before 1.2.9 fail to properly validate DOS drive letter prefixes in Git tree path elements on Windows operating systems. According to the National Vulnerability Database record, this validation gap allows attackers to craft a malicious repository containing a tree entry named 'C:'.
This crafted entry bypasses NTFS validation mechanisms, enabling the library to write files outside the designated worktree directory. The National Vulnerability Database assigns the flaw a CVSS score of 8.7, rating it as high severity. The weakness is classified under CWE-22, which covers improper limitation of a pathname to a restricted directory.
Why it matters
This vulnerability is particularly dangerous because it allows for remote code execution through standard Git operations. Attackers do not need direct access to the system; they only need to convince a user or automated system to process a malicious repository.
As Patch Gazette reported on October 9, 2026, unvalidated path parameters in tools like gvproxy have previously enabled arbitrary host file deletion. While that incident involved deletion, the Dulwich flaw enables writing, which is often a more direct path to installing malware or backdoors on a compromised machine.
What to watch
- Monitor for any new advisories from the Jelmer Dulwich maintainers regarding version 1.2.9.
- Review Git repository intake processes to identify where untrusted repositories are processed.
- Check Windows event logs for unusual file creation activities outside standard application directories.
- Verify that automated CI/CD pipelines are not pulling from unverified or untrusted Git sources.
Who needs to act first
Teams should prioritize updating systems that automatically fetch or process Git repositories from external sources. These environments present the highest exposure because they handle untrusted data without human intervention. Before applying any update, verify that the new version does not break existing integrations by testing in a isolated environment. Ensure that backups of current configurations are available before making changes. If an immediate update is not possible, restrict network access to prevent these systems from connecting to untrusted Git servers.
Background: CVSS score
The CVSS score explains vulnerability severity using a 0.0 to 10.0 scale. It measures attack vector, complexity, privileges required, and impact on confidentiality, integrity, and availability. You use this metric to prioritize patches, though you must adjust it for your specific environment to avoid wasting time on irrelevant threats.
Read the full guide: CVSS Score Explained: How to Read Risk Metrics and Prioritize Fixes
What to do and how to stay safe: Dulwich
- Audit your environment to identify all instances where the Dulwich library is used, particularly in CI/CD pipelines.
- Restrict access to Git repositories so that only verified and trusted sources can be pulled by your systems.
- Monitor system logs for unexpected file creation events, especially those occurring outside of designated application directories.
- Wait for the vendor to release version 1.2.9 or later before applying the fix, as no patch has been confirmed yet.
Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks
General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for the Dulwich vulnerability?
The National Vulnerability Database rates CVE-2026-114094 with a CVSS score of 8.7, which is classified as high severity.
Which versions of Dulwich are affected by this flaw?
All versions of the Jelmer Dulwich library before version 1.2.9 are affected by this arbitrary file write vulnerability.
Does a fix exist for CVE-2026-114094?
No fix has been confirmed yet; users should wait for the vendor to release a patched version of the library.
