CVE-2026-47712

A flaw was found in Dulwich, a pure-Python implementation of Git file formats and protocols. A remote attacker could exploit this vulnerability by crafting a malicious commit subject. When the format_patch function processes this subject, it could lead to an arbitrary file write, allowing the attacker to create or overwrite files outside the intended output directory. This could result in unauthorized modification of system files or data.

This Low impact path traversal vulnerability in Dulwich affects the format_patch function when processing commit subjects. A malicious commit subject containing path separator characters could cause patch files to be written outside the intended output directory. Exploitation requires passing untrusted commit data to the format_patch function.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.