Symlink Attack Affecting dulwich package, versions [0.23.1,1.2.8)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-DULWICH-20416730
- published4 Oct 2026
- disclosed2 Oct 2026
- creditmanus-use
Introduced: 2 Oct 2026
New CVE NOT AVAILABLE CWE-22 (opens in a new tab)How to fix?
Upgrade dulwich to version 1.2.8 or higher.
Overview
Affected versions of this package are vulnerable to Symlink Attack via _apply_index_filter in dulwich/filter_branch.py, which called build_index_from_tree(".", ...) to materialize tree entries into the caller's working directory and left them there between commits. An attacker can craft a repository whose ancestor commit places a symlink (e.g. evil pointing outside the work tree) and whose descendant commit places a regular file at evil/payload: when filter-branch processes the descendant, it follows the persisted symlink and writes the file to an arbitrary location outside the work tree.