CVE-2026-42305
Dulwich has an arbitrary file write via NTFS-hostile tree entries on Windows
Description
Dulwich is a pure-Python implementation of the Git file formats and protocols. Versions starting with 0.10.0 and prior to 1.2.5 have an arbitrary file write leading to remote code execution when cloning or checking out a malicious Git repository on Windows. Dulwich's path-element validator accepted tree entries whose filenames contained bytes that Windows interprets as structural path syntax. Contributing configuration bugs made matters worse. The core.protectNTFS and core.protectHFS settings were looked up under a wrong option name and so user-set values were silently ignored, and core.protectNTFS only defaulted to true on Windows (Git upstream has defaulted it to true everywhere since CVE-2019-1353). Both have been corrected. Anyone who clones, fetches, or checks out an untrusted repository with Dulwich on Windows - either through the Dulwich CLI, porcelain.clone, or any downstream tool built on Dulwich - is impacted. POSIX clones are not directly exploitable (on POSIX \ is a literal filename byte), but a POSIX user can unknowingly propagate a malicious tree to Windows consumers via push or re-publication. This issue is fixed in Dulwich 1.2.5. Users should upgrade to 1.2.5 or later. There is no effective pre-patch workaround. On affected versions the core.protectNTFS configuration key was silently ignored, so setting it to true does not mitigate the issue. Users who cannot upgrade should avoid cloning, fetching, or checking out untrusted repositories with Dulwich on Windows. After upgrading the NTFS validator is on by default on every platform, so no additional configuration is required.
INFO
Published Date :
June 10, 2026, 11:16 p.m.
Last Modified :
July 23, 2026, 9:10 a.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | HIGH | [email protected] |
Solution
- Upgrade Dulwich to version 1.2.5 or later.
- Avoid untrusted repositories if upgrade is not possible.
- Ensure core.protectNTFS is enabled.
- Configure NTFS validator on all platforms.
Public PoC/Exploit Available at Github
CVE-2026-42305 has a 1 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-42305.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-42305 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-42305
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
All Public RunWhen Helm Charts - Managed by terraform
Shell Dockerfile Go Template
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-42305 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-42305 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Jul. 23, 2026
Action Type Old Value New Value Added Translation Title: Dulwich de jelmer, Description: Dulwich es una implementación pura de Python de los formatos y protocolos de archivo de Git. Las versiones a partir de la 0.10.0 y anteriores a la 1.2.5 tienen una escritura de archivo arbitraria que conduce a ejecución remota de código al clonar o extraer un repositorio Git malicioso en Windows. El validador de elementos de ruta de Dulwich aceptaba entradas de árbol cuyos nombres de archivo contenían bytes que Windows interpreta como sintaxis de ruta estructural. Errores de configuración contribuyentes empeoraron las cosas. Las configuraciones core.protectNTFS y core.protectHFS se buscaron bajo un nombre de opción incorrecto y por lo tanto los valores establecidos por el usuario fueron ignorados silenciosamente, y core.protectNTFS solo se estableció por defecto en verdadero en Windows (Git upstream lo ha establecido por defecto en verdadero en todas partes desde CVE-2019-1353). Ambos han sido corregidos. Cualquiera que clone, obtenga o extraiga un repositorio no confiable con Dulwich en Windows - ya sea a través de la CLI de Dulwich, porcelain.clone, o cualquier herramienta derivada construida sobre Dulwich - se ve afectado. Las clonaciones POSIX no son directamente explotables (en POSIX \ es un byte literal de nombre de archivo), pero un usuario POSIX puede propagar sin saberlo un árbol malicioso a los consumidores de Windows a través de un push o republicación. Este problema está solucionado en Dulwich 1.2.5. Los usuarios deben actualizar a la versión 1.2.5 o posterior. No existe una solución alternativa pre-parche efectiva. En las versiones afectadas, la clave de configuración core.protectNTFS fue ignorada silenciosamente, por lo que establecerla en verdadero no mitiga el problema. Los usuarios que no pueden actualizar deben evitar clonar, obtener o extraer repositorios no confiables con Dulwich en Windows. Después de actualizar, el validador NTFS está activado por defecto en todas las plataformas, por lo que no se requiere configuración adicional. -
CVE Modified by [email protected]
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'jelmer', 'product': 'dulwich', 'versions': [{'status': 'affected', 'version': '>= 0.10.0, < 1.2.5'}]}] -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 17, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-42305', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-06-11T00:00:00+00:00'} -
New CVE Received by [email protected]
Jun. 10, 2026
Action Type Old Value New Value Added Description Dulwich is a pure-Python implementation of the Git file formats and protocols. Versions starting with 0.10.0 and prior to 1.2.5 have an arbitrary file write leading to remote code execution when cloning or checking out a malicious Git repository on Windows. Dulwich's path-element validator accepted tree entries whose filenames contained bytes that Windows interprets as structural path syntax. Contributing configuration bugs made matters worse. The core.protectNTFS and core.protectHFS settings were looked up under a wrong option name and so user-set values were silently ignored, and core.protectNTFS only defaulted to true on Windows (Git upstream has defaulted it to true everywhere since CVE-2019-1353). Both have been corrected. Anyone who clones, fetches, or checks out an untrusted repository with Dulwich on Windows - either through the Dulwich CLI, porcelain.clone, or any downstream tool built on Dulwich - is impacted. POSIX clones are not directly exploitable (on POSIX \ is a literal filename byte), but a POSIX user can unknowingly propagate a malicious tree to Windows consumers via push or re-publication. This issue is fixed in Dulwich 1.2.5. Users should upgrade to 1.2.5 or later. There is no effective pre-patch workaround. On affected versions the core.protectNTFS configuration key was silently ignored, so setting it to true does not mitigate the issue. Users who cannot upgrade should avoid cloning, fetching, or checking out untrusted repositories with Dulwich on Windows. After upgrading the NTFS validator is on by default on every platform, so no additional configuration is required. Added CVSS V3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Added CWE CWE-22 Added Reference https://github.com/jelmer/dulwich/commit/49eb56e51aad637fc23d54bf2a08cb42739b8290 Added Reference https://github.com/jelmer/dulwich/commit/57efc4aa1581e038915a0fd79365be53b150f4a9 Added Reference https://github.com/jelmer/dulwich/releases/tag/dulwich-1.2.5 Added Reference https://github.com/jelmer/dulwich/security/advisories/GHSA-897w-fcg9-f6xj