https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 16 Oct 2026 11:27:48 +0000 https://cve.radiocsirt.org/vuln/ghsa-cm62-gvxx-vmxx <p><strong>Affected:</strong> PyPI: dulwich</p> <p>## Summary</p> <p>Dulwich&#39;s `stash.py:pop()` function is vulnerable to symlink directory traversal, allowing an attacker to write arbitrary files outside the repository worktree when a victim pops a stash in a malicious repository.</p> <p>## Root Cause</p> <p>The `pop()` function at `dulwich/stash.py:236` uses `os.path.exists(parent_dir)` to check if a parent directory exists before writing stashed files. `os.path.exists()` follows symlinks, so when an intermediate directory in the path is a symlink pointing outside the worktree (e.g., `link → ../../.git/hooks`), the check passes and subsequent file writes resolve through the symlink.</p> <p>The `validate_path()` function (line 228) only validates path component names against `INVALID_DOTNAMES` — it performs zero filesystem symlink detection. On dulwich 1.2.7 (latest release), `build_file_from_blob()` has no symlink protection whatsoever.</p> <p>## Impact</p> <p>An attacker can craft a malicious repository that, when a victim clones it and performs a stash pop operation, writes attacker-controlled content to arbitrary filesystem locations. Writing to `.git/hooks/post-checkout` achieves Remote Code Execution on the victim&#39;s machine on the next git checkout operation.</p> <p>## Attack Scenario</p> <p>1. Attacker creates a repository with branch `main` containing `link` (symlink → `../../.git/hooks`) and branch `feature` containing `link/post-checkout` (executable payload) 2. Victim clones the repository (landing on `main` — symlink `link` exists in worktree) 3. Victim check…</p> <p><strong>Affected:</strong> PyPI: dulwich</p> <p>## Summary</p> <p>Dulwich&#39;s `stash.py:pop()` function is vulnerable to symlink directory traversal, allowing an attacker to write arbitrary files outside the repository worktree when a victim pops a stash in a malicious repository.</p> <p>## Root Cause</p> <p>The `pop()` function at `dulwich/stash.py:236` uses `os.path.exists(parent_dir)` to check if a parent directory exists before writing stashed files. `os.path.exists()` follows symlinks, so when an intermediate directory in the path is a symlink pointing outside the worktree (e.g., `link → ../../.git/hooks`), the check passes and subsequent file writes resolve through the symlink.</p> <p>The `validate_path()` function (line 228) only validates path component names against `INVALID_DOTNAMES` — it performs zero filesystem symlink detection. On dulwich 1.2.7 (latest release), `build_file_from_blob()` has no symlink protection whatsoever.</p> <p>## Impact</p> <p>An attacker can craft a malicious repository that, when a victim clones it and performs a stash pop operation, writes attacker-controlled content to arbitrary filesystem locations. Writing to `.git/hooks/post-checkout` achieves Remote Code Execution on the victim&#39;s machine on the next git checkout operation.</p> <p>## Attack Scenario</p> <p>1. Attacker creates a repository with branch `main` containing `link` (symlink → `../../.git/hooks`) and branch `feature` containing `link/post-checkout` (executable payload) 2. Victim clones the repository (landing on `main` — symlink `link` exists in worktree) 3. Victim check…</p> https://cve.radiocsirt.org/vuln/ghsa-cm62-gvxx-vmxx