{"id":"CVE-2026-114098","published":"2026-10-21T01:17:35.263","lastModified":"2026-10-21T01:17:35.387","description":"Dulwich from 0.22.5 before 1.2.8 contains a path traversal vulnerability in stash.py pop() that allows attackers to write arbitrary files outside the worktree through intermediate directory symlinks. Attackers can craft a malicious repository whose popped stash writes a payload into .git/hooks/post-checkout, achieving code execution on the next checkout.","cvssScore":7.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-22"],"vendors":[],"products":[],"references":[{"url":"https://github.com/jelmer/dulwich/security/advisories/GHSA-cm62-gvxx-vmxx","tags":[]},{"url":"https://www.vulncheck.com/advisories/dulwich-0.22.5-before-1.2.8-path-traversal-via-stash-pop-symlinks","tags":[]}],"exploitRefs":[{"url":"https://github.com/jelmer/dulwich/security/advisories/GHSA-cm62-gvxx-vmxx","tags":[]}],"hasPoc":true,"ai":null}