https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-23T15:31:57.413242+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-114096 fkie_cve-2026-114096 2026-10-23T15:31:57.415005+00:00

Dulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in porcelain.checkout(paths=[...]) that allows attackers to write arbitrary files by abusing raw os.open without O_NOFOLLOW. Attackers can craft a repository where a worktree symlink points to .git/hooks/post-checkout, so restoring the file from a tag writes a malicious hook for code execution.

 https://db.gcve.eu/vuln/ghsa-8wh8-hpg9-jvx8 GHSA-8wh8-hpg9-jvx8 2026-10-23T15:31:57.415132+00:00

Dulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in porcelain.checkout(paths=[...]) that allows attackers to write arbitrary files by abusing raw os.open without O_NOFOLLOW. Attackers can craft a repository where a worktree symlink points to .git/hooks/post-checkout, so restoring the file from a tag writes a malicious hook for code execution.

 https://db.gcve.eu/vuln/ubuntu-cve-2026-114096 UBUNTU-CVE-2026-114096 2026-10-23T15:31:57.415159+00:00

Affected: Ubuntu:16.04:LTS: dulwich, Ubuntu:18.04:LTS: dulwich, Ubuntu:20.04:LTS: dulwich, Ubuntu:22.04:LTS: dulwich, Ubuntu:24.04:LTS: dulwich, Ubuntu:26.04:LTS: dulwich

(Dulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerab ...)