CVE-2026-114094: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in jelmer dulwich

The vulnerability in Dulwich prior to version 1.2.9 arises from failure to properly validate DOS drive letter prefixes in Git tree path elements on Windows platforms. This improper limitation of pathname allows an attacker to create a malicious Git repository containing a tree entry named 'C:', which circumvents NTFS validation mechanisms. As a result, arbitrary files can be written outside the designated worktree directory. This capability can be exploited to achieve remote code execution by placing malicious files in sensitive locations on the target system.

Successful exploitation allows an unauthenticated attacker to write arbitrary files outside the intended repository directory on Windows systems, potentially leading to remote code execution. This can compromise system integrity and confidentiality by enabling execution of attacker-controlled code.

A fix is available in Dulwich version 1.2.9. Users should upgrade to version 1.2.9 or later to remediate this vulnerability. No other mitigation is stated in the available data.