CVE-2026-114096

A flaw was found in Dulwich. When checking out specific file paths, the application improperly follows symbolic links when creating or restoring files. By tricking a user into checking out files from a maliciously crafted repository, an attacker can write arbitrary files to the local filesystem, which can lead to arbitrary code execution.

Red Hat rates this vulnerability as having an Important security impact because successful exploitation allows arbitrary file overwrite and subsequent code execution within the privileges of the executing process, though it requires interacting with a maliciously constructed Git repository. Exploitation is contingent upon an automated workflow or user processing an untrusted source repository that contains crafted symbolic links.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.