CVE-2026-114098: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in jelmer dulwich

The vulnerability in Dulwich (CVE-2026-114098) involves improper limitation of a pathname to a restricted directory, specifically a path traversal issue in the stash.py pop() method. This allows an attacker to escape the repository's worktree directory by using intermediate symlinks, resulting in arbitrary file writes outside the expected directory. By placing a malicious payload into the .git/hooks/post-checkout hook, an attacker can achieve code execution when the next git checkout is performed. The affected versions are from 0.22.5 up to but excluding 1.2.8.

Successful exploitation allows an attacker with the ability to supply a malicious repository to write arbitrary files outside the repository worktree, including the .git/hooks/post-checkout hook. This can lead to arbitrary code execution on the victim's system during the next git checkout operation, posing a high security risk.

A fix is available in Dulwich version 1.2.8 and later. Users should upgrade to version 1.2.8 or newer to remediate this vulnerability. No vendor advisory content was provided to indicate alternative mitigations or temporary fixes.