Symlink Attack Affecting dulwich package, versions [0.22.5,1.2.8)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-DULWICH-20416731
- published4 Oct 2026
- disclosed2 Oct 2026
- creditmanus-use
Introduced: 2 Oct 2026
New CVE NOT AVAILABLE CWE-22 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade dulwich to version 1.2.8 or higher.
Overview
Affected versions of this package are vulnerable to Symlink Attack via _verify_leading_dirs (absent in affected versions) in dulwich/stash.py during stash.pop. The old path-existence check used os.path.exists, which follows symlinks, so a stash entry whose parent path component is a symlink already present in the worktree (for example, link pointing to .git/hooks) causes the subsequent file write to land outside the work tree. An attacker who can supply a crafted stash can redirect writes to arbitrary locations accessible by the victim user.