CVE-2026-42305 is a path traversal vulnerability (CWE-22) in the Dulwich Git implementation affecting versions starting from 0.10.0 up to but not including 1.2.5. On Windows, the path-element validator failed to properly restrict filenames containing bytes interpreted as structural path syntax, enabling arbitrary file writes during cloning or checkout of malicious repositories. Configuration options core.protectNTFS and core.protectHFS were incorrectly referenced, causing user-set protections to be ignored. This vulnerability allows remote code execution on Windows systems. POSIX systems are not directly vulnerable but can unknowingly propagate malicious trees to Windows users. The vulnerability is resolved in Dulwich 1.2.5, which corrects the validator and configuration handling, enabling NTFS protection by default on all platforms.

Successful exploitation allows an attacker to perform arbitrary file writes on Windows systems during Git operations with Dulwich, potentially leading to remote code execution. This affects users who clone, fetch, or check out untrusted repositories using Dulwich on Windows, including via the Dulwich CLI, porcelain.clone, or downstream tools. POSIX users are not directly exploitable but can propagate malicious content to Windows users. The vulnerability compromises confidentiality, integrity, and availability on affected systems.

A fixed version, Dulwich 1.2.5, is available and users should upgrade to this version or later. There is no effective workaround for affected versions because the core.protectNTFS configuration key was silently ignored, so setting it does not mitigate the issue. Users unable to upgrade should avoid cloning, fetching, or checking out untrusted repositories with Dulwich on Windows. After upgrading, NTFS protection is enabled by default on all platforms, requiring no additional configuration.