← CVE index
Vulnerability record/PUBLISHED/Published Oct 21, 2026 00:36:58 UTC

CVE-2026-114094

Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrary file write. Attackers can craft a malicious repository with a tree entry named 'C:' that bypasses NTFS validation and writes files outside the worktree to achieve remote code execution.

Base score8.7/ 10
SeverityHighCVSS 4.0

Exploitability / impact

CVSS metric breakdown

Vector-derived attributes
Base severityHigh
Attack vectorNetworkAV
Attack complexityLowAC
Attack requirementsNoneAT
Privileges requiredNonePR
User interactionPassiveUI
Vulnerable system confidentialityHighVC
Vulnerable system integrityHighVI
Vulnerable system availabilityHighVA
Subsequent system confidentialityNoneSC
Subsequent system integrityNoneSI
Subsequent system availabilityNoneSA
CVSS vector stringCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.

Record context

CVE Numbering AuthorityVulnCheck
Last updatedOct 28, 2026 15:57:01 UTC
PublishedOct 21, 2026 00:36:58 UTC
ReservedOct 20, 2026 21:46:55 UTC

Credits

  • LukeBanto
  • jelmer