How severe is CVE-2026-114098?

No CVSS score has been assigned to CVE-2026-114098 yet. Review the advisory details and affected package list to assess your exposure.

Which packages are affected by CVE-2026-114098?

CVE-2026-114098 affects the following packages: dulwich (PyPI). Ecosystems affected: PyPI.

How do I fix CVE-2026-114098?

Update dulwich to 1.2.8 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-114098 is resolved across your whole dependency graph.

How do I detect CVE-2026-114098 in my PyPI dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for dulwich, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

How do I mitigate CVE-2026-114098 if there is no patch (or I can't update yet)?

Resolve every user-supplied path to its canonical form and reject anything that escapes the intended directory, and run the component under an account that has no read or write access outside the directory it legitimately serves.

Is CVE-2026-114098 actively exploited in the wild?

No public exploit code has been indexed for CVE-2026-114098 yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

What is the EPSS score for CVE-2026-114098?

CVE-2026-114098 has an EPSS (Exploit Prediction Scoring System) score of 0.2%, placing it in the 4th percentile of all CVEs. EPSS is maintained by FIRST.org and estimates the probability that a vulnerability will be exploited in the wild within the next 30 days. This score indicates relatively lower exploitation probability, though the CVSS severity should still guide your patching priority.

What type of vulnerability is CVE-2026-114098?

CVE-2026-114098 is classified as Path Traversal (CWE-22). This weakness type describe the underlying flaw category, which helps determine the potential impact and the right class of mitigation. This is a high-impact weakness class that often enables remote code execution or data exposure.

When was CVE-2026-114098 published, and has it been updated?

CVE-2026-114098 was published on October 21, 2026 and was last updated on October 24, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

🐍 PyPI

Not in CISA KEV

CVE-2026-114098 — dulwich

Fix: jelmer/dulwich@40a542c

CVE-2026-114098 is a Path Traversal vulnerability in dulwich. A fix is available for dulwich — see the affected versions and patch details below.

Dulwich 0.22.5 before 1.2.8 Path Traversal via Stash Pop Symlinks

Also known asGHSA-cm62-gvxx-vmxx

Published

Oct 21, 2026

Updated

Oct 24, 2026

Affected

1 pkg

Patched

1 / 1

Exploits

None indexed

Exploitation data as of Oct 23, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

EPSS Exploitation Probability

via FIRST.org ↗

0.2%probability of exploitation in next 30 days

Lower Risk0.00%

Lower risk than most CVEs4th percentile — riskier than 4% of all scored CVEsHighest risk

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

Real-World Exposure

1 pkg affected

🐍dulwich

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.

Description

Summary

Dulwich's stash.py:pop() function is vulnerable to symlink directory traversal, allowing an attacker to write arbitrary files outside the repository worktree when a victim pops a stash in a malicious repository.

Root Cause

The pop() function at dulwich/stash.py:236 uses os.path.exists(parent_dir) to check if a parent directory exists before writing stashed files. os.path.exists() follows symlinks, so when an intermediate directory in the path is a symlink pointing outside the worktree (e.g., link → ../../.git/hooks), the check passes and subsequent file writes resolve through the symlink.

The validate_path() function (line 228) only validates path component names against INVALID_DOTNAMES — it performs zero filesystem symlink detection. On dulwich 1.2.7 (latest release), build_file_from_blob() has no symlink protection whatsoever.

Impact

An attacker can craft a malicious repository that, when a victim clones it and performs a stash pop operation, writes attacker-controlled content to arbitrary filesystem locations. Writing to .git/hooks/post-checkout achieves Remote Code Execution on the victim's machine on the next git checkout operation.

Attack Scenario

Attacker creates a repository with branch main containing link (symlink → ../../.git/hooks) and branch feature containing link/post-checkout (executable payload)
Victim clones the repository (landing on main — symlink link exists in worktree)
Victim checks out feature, makes changes, runs stash.push()
Victim checks out main (restoring the link symlink)
Victim runs stash.pop(0) — stash contains link/post-checkout
os.path.exists("link") returns True (symlink to existing directory), os.makedirs skipped
build_file_from_blob(blob, mode, "link/post-checkout") → open("link/post-checkout", "wb") follows the intermediate symlink → payload written to .git/hooks/post-checkout
Next checkout operation triggers the hook → RCE

Suggested Fix

Before writing any file, verify that no component of the target path resolves through a symlink outside the worktree. Use os.path.realpath(parent_dir) and confirm it stays within the repository root. Alternatively, use os.open() with O_NOFOLLOW on each path component.

Reported by zx (Jace)

Affected Packages

1 total 1 fixed

Ecosystem	Package	Vulnerable range	Fix
🐍PyPI	`dulwich`	≥ 0.22.5&&< 1.2.8	1.2.8`pip install --upgrade 'dulwich==1.2.8'`

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for dulwich, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update dulwich to 1.2.8 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-114098 is resolved across your whole dependency graph.
Workarounds
Resolve every user-supplied path to its canonical form and reject anything that escapes the intended directory, and run the component under an account that has no read or write access outside the directory it legitimately serves.

Frequently Asked Questions

## Summary Dulwich's `stash.py:pop()` function is vulnerable to symlink directory traversal, allowing an attacker to write arbitrary files outside the repository worktree when a victim pops a stash in a malicious repository. ## Root Cause The `pop()` function at `dulwich/stash.py:236` uses `os.path.exists(parent_dir)` to check if a parent directory exists before writing stashed files. `os.path.exists()` follows symlinks, so when an intermediate directory in the path is a symlink pointing outside the worktree (e.g., `link → ../../.git/hooks`), the check passes and subsequent file writes reso

O3 Security · Impact-Aware SCA

Is CVE-2026-114098 in your dependencies?

Find it across PyPI, including transitive dependencies.

Scan my dependencies How O3 SCA works