https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-23T15:32:58.979349+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-114096 CVE-2026-114096 — Dulwich 0.24.0 before 1.2.8 Symlink Write-Through via porcelain.checkout paths 2026-10-23T15:32:58.980722+00:00

Affected: jelmer dulwich

Dulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in porcelain.checkout(paths=[...]) that allows attackers to write arbitrary files by abusing raw os.open without O_NOFOLLOW. Attackers can craft a repository where a worktree symlink points to .git/hooks/post-checkout, so restoring the file from a tag writes a malicious hook for code execution.