CVE-2026-114094
HIGH
NVD
CVSS Score
8.8
Severity
HIGH
Published
Oct 21, 2026
Vendor
unknown
Description
Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrary file write. Attackers can craft a malicious repository with a tree entry named 'C:' that bypasses NTFS validation and writes files outside the worktree to achieve remote code execution.