UNIX Symbolic Link (Symlink) Following Affecting dulwich package, versions [0.24.0,1.2.8)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-DULWICH-20416733
- published4 Oct 2026
- disclosed2 Oct 2026
- creditmanus-use
Introduced: 2 Oct 2026
New CVE NOT AVAILABLE CWE-59 (opens in a new tab)How to fix?
Upgrade dulwich to version 1.2.8 or higher.
Overview
Affected versions of this package are vulnerable to UNIX Symbolic Link (Symlink) Following via the paths= branch of porcelain.checkout in dulwich, which wrote file content using a raw os.open(file_path, O_WRONLY|O_CREAT|O_TRUNC) call that follows existing symlinks at the target path. An attacker can craft a repository that places a symlink pointing outside the work tree at a known path, then have a victim perform a path-restricted checkout, causing attacker-controlled content to be written to arbitrary locations the user can write to - including .git/hooks for code execution. The fix routes all writes through build_file_from_blob, which replaces a symlink at the target rather than following it.