Dulwich EUVD-2026-106897

Requires (1) the victim to be running Dulwich on a Windows (NTFS) client - Linux/macOS are not affected; (2) the victim to clone or check out an attacker-controlled repository, i.e. passive user interaction such as a normal clone, checkout, or an automated Windows CI runner cloning a malicious pull request; and (3) the attacker to author a Git tree entry whose name is a DOS drive-letter prefix like 'C:', which passes validate_path_element_ntfs and causes os.path.join to discard the worktree root. No authentication against the victim is needed and default configurations are vulnerable, but the limiting factors are the mandatory Windows platform and the requirement that the victim initiate a clone/checkout of hostile repository content.

This is a genuinely serious flaw but one whose real-world risk is gated by specific preconditions. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H, score 8.7) indicates a network-delivered, low-complexity, unauthenticated path-traversal that yields high confidentiality, integrity and availability impact - consistent with the described arbitrary file write escalating to RCE. The critical caveat is UI:P (passive user interaction) and the platform constraint: exploitation only triggers when a Windows client clones or checks out the malicious repository, and Linux/macOS clients are unaffected. No CISA KEV listing and no EPSS score were supplied in the input, so there is no signal of active or probabilistically-likely exploitation; however, the GHSA advisory publishes a working proof-of-concept, so publicly available exploit code exists. The signals are therefore consistent rather than conflicting: high technical impact and a public PoC, but exploitation requires attacker-authored repo content plus a Windows victim who performs a clone/checkout, which argues for targeted (e.g. malicious pull request against a Windows CI runner) rather than opportunistic mass exploitation. Treat as a real priority specifically for Windows environments and Windows-based CI/CD using Dulwich; lower priority for Linux-only deployments. Note no EPSS/KEV data was provided - absence is not evidence of low risk, and the public PoC meaningfully raises practical exploitability.

An attacker authors a malicious Git repository (craftable on Linux) containing a tree entry named 'C:' that bypasses Dulwich's NTFS path validation. When a Windows victim - for example a GitHub Actions runner that auto-clones an incoming pull request - checks out the repository, os.path.join discards the worktree root and writes the attacker's file to an absolute path such as C:\Users\<victim>\.gitconfig, poisoning core.sshCommand to gain code execution. A proof-of-concept generator is published in the GHSA advisory, and because UI is passive the victim only needs to perform a normal clone/checkout.