CVE-2026-114097: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in jelmer dulwich

CVE-2026-114097 is a path traversal vulnerability in the Dulwich library (versions >=0.23.1 <1.2.8) within the CommitFilter._apply_index_filter() method. The vulnerability arises because symlinks from ancestor commits can redirect file writes in descendant commits outside the working directory during the filter_branch process. This allows an attacker to write arbitrary files, including potentially malicious code into .git/hooks, enabling code execution.

Successful exploitation allows an attacker with the ability to craft repository commits to write files outside the working directory, including into the .git/hooks directory. This can lead to arbitrary code execution on the system where Dulwich is used, posing a high security risk.

No explicit patch or remediation details are provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted repositories with vulnerable versions of Dulwich or apply manual controls to prevent symlink-based path traversal during commit filtering.