CVE-2026-42305

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-42305", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-26T12:13:55.553Z", "datePublished": "2026-06-10T21:55:30.942Z", "dateUpdated": "2026-06-12T03:55:29.808Z"}, "containers": {"cna": {"title": "Dulwich has an arbitrary file write via NTFS-hostile tree entries on Windows", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/jelmer/dulwich/security/advisories/GHSA-897w-fcg9-f6xj", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/jelmer/dulwich/security/advisories/GHSA-897w-fcg9-f6xj"}, {"name": "https://github.com/jelmer/dulwich/commit/49eb56e51aad637fc23d54bf2a08cb42739b8290", "tags": ["x_refsource_MISC"], "url": "https://github.com/jelmer/dulwich/commit/49eb56e51aad637fc23d54bf2a08cb42739b8290"}, {"name": "https://github.com/jelmer/dulwich/commit/57efc4aa1581e038915a0fd79365be53b150f4a9", "tags": ["x_refsource_MISC"], "url": "https://github.com/jelmer/dulwich/commit/57efc4aa1581e038915a0fd79365be53b150f4a9"}, {"name": "https://github.com/jelmer/dulwich/releases/tag/dulwich-1.2.5", "tags": ["x_refsource_MISC"], "url": "https://github.com/jelmer/dulwich/releases/tag/dulwich-1.2.5"}], "affected": [{"vendor": "jelmer", "product": "dulwich", "versions": [{"version": ">= 0.10.0, < 1.2.5", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-10T21:55:30.942Z"}, "descriptions": [{"lang": "en", "value": "Dulwich is a pure-Python implementation of the Git file formats and protocols. Versions starting with 0.10.0 and prior to 1.2.5 have an arbitrary file write leading to remote code execution when cloning or checking out a malicious Git repository on Windows. Dulwich's path-element validator accepted tree entries whose filenames contained bytes that Windows interprets as structural path syntax. Contributing configuration bugs made matters worse. The core.protectNTFS and core.protectHFS settings were looked up under a wrong option name and so user-set values were silently ignored, and core.protectNTFS only defaulted to true on Windows (Git upstream has defaulted it to true everywhere since CVE-2019-1353). Both have been corrected. Anyone who clones, fetches, or checks out an untrusted repository with Dulwich on Windows - either through the Dulwich CLI, porcelain.clone, or any downstream tool built on Dulwich - is impacted. POSIX clones are not directly exploitable (on POSIX \\ is a literal filename byte), but a POSIX user can unknowingly propagate a malicious tree to Windows consumers via push or re-publication. This issue is fixed in Dulwich 1.2.5. Users should upgrade to 1.2.5 or later. There is no effective pre-patch workaround. On affected versions the core.protectNTFS configuration key was silently ignored, so setting it to true does not mitigate the issue. Users who cannot upgrade should avoid cloning, fetching, or checking out untrusted repositories with Dulwich on Windows. After upgrading the NTFS validator is on by default on every platform, so no additional configuration is required."}], "source": {"advisory": "GHSA-897w-fcg9-f6xj", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-11T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-42305"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-12T03:55:29.808Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-42305", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-06-11T13:42:25.959011Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-11T13:42:30.383Z"}}], "cna": {"title": "Dulwich has an arbitrary file write via NTFS-hostile tree entries on Windows", "source": {"advisory": "GHSA-897w-fcg9-f6xj", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "jelmer", "product": "dulwich", "versions": [{"status": "affected", "version": ">= 0.10.0, < 1.2.5"}]}], "references": [{"url": "https://github.com/jelmer/dulwich/security/advisories/GHSA-897w-fcg9-f6xj", "name": "https://github.com/jelmer/dulwich/security/advisories/GHSA-897w-fcg9-f6xj", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/jelmer/dulwich/commit/49eb56e51aad637fc23d54bf2a08cb42739b8290", "name": "https://github.com/jelmer/dulwich/commit/49eb56e51aad637fc23d54bf2a08cb42739b8290", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/jelmer/dulwich/commit/57efc4aa1581e038915a0fd79365be53b150f4a9", "name": "https://github.com/jelmer/dulwich/commit/57efc4aa1581e038915a0fd79365be53b150f4a9", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/jelmer/dulwich/releases/tag/dulwich-1.2.5", "name": "https://github.com/jelmer/dulwich/releases/tag/dulwich-1.2.5", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Dulwich is a pure-Python implementation of the Git file formats and protocols. Versions starting with 0.10.0 and prior to 1.2.5 have an arbitrary file write leading to remote code execution when cloning or checking out a malicious Git repository on Windows. Dulwich's path-element validator accepted tree entries whose filenames contained bytes that Windows interprets as structural path syntax. Contributing configuration bugs made matters worse. The core.protectNTFS and core.protectHFS settings were looked up under a wrong option name and so user-set values were silently ignored, and core.protectNTFS only defaulted to true on Windows (Git upstream has defaulted it to true everywhere since CVE-2019-1353). Both have been corrected. Anyone who clones, fetches, or checks out an untrusted repository with Dulwich on Windows - either through the Dulwich CLI, porcelain.clone, or any downstream tool built on Dulwich - is impacted. POSIX clones are not directly exploitable (on POSIX \\ is a literal filename byte), but a POSIX user can unknowingly propagate a malicious tree to Windows consumers via push or re-publication. This issue is fixed in Dulwich 1.2.5. Users should upgrade to 1.2.5 or later. There is no effective pre-patch workaround. On affected versions the core.protectNTFS configuration key was silently ignored, so setting it to true does not mitigate the issue. Users who cannot upgrade should avoid cloning, fetching, or checking out untrusted repositories with Dulwich on Windows. After upgrading the NTFS validator is on by default on every platform, so no additional configuration is required."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-10T21:55:30.942Z"}}}, "cveMetadata": {"cveId": "CVE-2026-42305", "state": "PUBLISHED", "dateUpdated": "2026-06-12T03:55:29.808Z", "dateReserved": "2026-04-26T12:13:55.553Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-10T21:55:30.942Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "dulwich", "vendor": "jelmer", "versions": [{"status": "affected", "version": ">= 0.10.0, < 1.2.5"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Dulwich is a pure-Python implementation of the Git file formats and protocols. Versions starting with 0.10.0 and prior to 1.2.5 have an arbitrary file write leading to remote code execution when cloning or checking out a malicious Git repository on Windows. Dulwich's path-element validator accepted tree entries whose filenames contained bytes that Windows interprets as structural path syntax. Contributing configuration bugs made matters worse. The core.protectNTFS and core.protectHFS settings were looked up under a wrong option name and so user-set values were silently ignored, and core.protectNTFS only defaulted to true on Windows (Git upstream has defaulted it to true everywhere since CVE-2019-1353). Both have been corrected. Anyone who clones, fetches, or checks out an untrusted repository with Dulwich on Windows - either through the Dulwich CLI, porcelain.clone, or any downstream tool built on Dulwich - is impacted. POSIX clones are not directly exploitable (on POSIX \\ is a literal filename byte), but a POSIX user can unknowingly propagate a malicious tree to Windows consumers via push or re-publication. This issue is fixed in Dulwich 1.2.5. Users should upgrade to 1.2.5 or later. There is no effective pre-patch workaround. On affected versions the core.protectNTFS configuration key was silently ignored, so setting it to true does not mitigate the issue. Users who cannot upgrade should avoid cloning, fetching, or checking out untrusted repositories with Dulwich on Windows. After upgrading the NTFS validator is on by default on every platform, so no additional configuration is required."}, {"lang": "es", "value": "Dulwich es una implementaci\u00f3n pura de Python de los formatos y protocolos de archivo de Git. Las versiones a partir de la 0.10.0 y anteriores a la 1.2.5 tienen una escritura de archivo arbitraria que conduce a ejecuci\u00f3n remota de c\u00f3digo al clonar o extraer un repositorio Git malicioso en Windows. El validador de elementos de ruta de Dulwich aceptaba entradas de \u00e1rbol cuyos nombres de archivo conten\u00edan bytes que Windows interpreta como sintaxis de ruta estructural. Errores de configuraci\u00f3n contribuyentes empeoraron las cosas. Las configuraciones core.protectNTFS y core.protectHFS se buscaron bajo un nombre de opci\u00f3n incorrecto y por lo tanto los valores establecidos por el usuario fueron ignorados silenciosamente, y core.protectNTFS solo se estableci\u00f3 por defecto en verdadero en Windows (Git upstream lo ha establecido por defecto en verdadero en todas partes desde CVE-2019-1353). Ambos han sido corregidos. Cualquiera que clone, obtenga o extraiga un repositorio no confiable con Dulwich en Windows - ya sea a trav\u00e9s de la CLI de Dulwich, porcelain.clone, o cualquier herramienta derivada construida sobre Dulwich - se ve afectado. Las clonaciones POSIX no son directamente explotables (en POSIX \\ es un byte literal de nombre de archivo), pero un usuario POSIX puede propagar sin saberlo un \u00e1rbol malicioso a los consumidores de Windows a trav\u00e9s de un push o republicaci\u00f3n. Este problema est\u00e1 solucionado en Dulwich 1.2.5. Los usuarios deben actualizar a la versi\u00f3n 1.2.5 o posterior. No existe una soluci\u00f3n alternativa pre-parche efectiva. En las versiones afectadas, la clave de configuraci\u00f3n core.protectNTFS fue ignorada silenciosamente, por lo que establecerla en verdadero no mitiga el problema. Los usuarios que no pueden actualizar deben evitar clonar, obtener o extraer repositorios no confiables con Dulwich en Windows. Despu\u00e9s de actualizar, el validador NTFS est\u00e1 activado por defecto en todas las plataformas, por lo que no se requiere configuraci\u00f3n adicional."}], "id": "CVE-2026-42305", "lastModified": "2026-07-23T09:10:00.113", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42305", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-06-11T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-06-10T23:16:46.113", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/jelmer/dulwich/commit/49eb56e51aad637fc23d54bf2a08cb42739b8290"}, {"source": "security-advisories@github.com", "url": "https://github.com/jelmer/dulwich/commit/57efc4aa1581e038915a0fd79365be53b150f4a9"}, {"source": "security-advisories@github.com", "url": "https://github.com/jelmer/dulwich/releases/tag/dulwich-1.2.5"}, {"source": "security-advisories@github.com", "url": "https://github.com/jelmer/dulwich/security/advisories/GHSA-897w-fcg9-f6xj"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.10.0,1.2.5)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "dulwich", "source": "cna", "vendor": "jelmer"}, "product": "dulwich", "vendor": "jelmer"}], "created": "2026-06-10T23:30:44.131853+00:00", "updated": "2026-06-11T10:40:41.618155+00:00", "vendors": ["jelmer", "jelmer$PRODUCT$dulwich"]}