CVE-2026-114097

A flaw was found in Dulwich. This vulnerability allows an attacker to achieve arbitrary code execution by tricking a user into running branch filtering operations on a specially crafted Git repository. Because temporary files persist between commit processing cycles, symbolic links created in earlier commits can redirect subsequent file write operations outside the working directory, allowing an attacker to overwrite sensitive files such as executable Git hook scripts.

This vulnerability is rated as having an Important severity because successful exploitation can result in arbitrary code execution within the application context if untrusted repositories are processed. Red Hat products embedding Dulwich are only susceptible if they run branch filtering operations on untrusted Git repositories. Exploitation requires user interaction or an automated workflow to process a malicious repository where residual symlinks redirect file writes during index filtering.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.