CVE-2026-114094

A flaw was found in Dulwich. On Windows systems, the application fails to validate drive letter prefixes within repository paths during checkout operations. A remote attacker could exploit this flaw by enticing a user to clone or check out a specially crafted Git repository containing malicious path entries. This vulnerability allows arbitrary files to be written outside the target working directory, which can lead to arbitrary code execution.

Red Hat has classified this flaw as Important because processing an untrusted repository could allow arbitrary file write and remote code execution if path validation is bypassed. The vulnerability relies on Windows operating systems interpreting DOS volume prefixes during path resolution to escape the target worktree directory. Because Red Hat platforms and container products operate in Linux environments using POSIX path semantics, standard deployments do not interpret drive letter prefixes as root path specifiers, preventing this specific traversal mechanism.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.