HighBreach
Dulwich: Arbitrary File Write (RCE) on Windows via Unvalidated Drive Letters in Tree Paths
GitHub Security Advisories·Source published ·1 min read
What happened?
Affected files * dulwich/index.py (Methods: validate_path_element_ntfs, _tree_to_fs_path) * dulwich/porcelain/init.py (Method: _checked_worktree_path) Description / Summary A High-severity Path Traversal vulnerability exists in Dulwich's checkout logic when running on Windows. The functions responsible for validating NTFS paths strictly reject.git variants, Alternate Data Streams (ADS), git~1 short names, and reserved device names, but they completely fail to check fo
Key details
- Arbitrary file write outside the worktree can be escalated to remote code execution on the victim's Windows machine.
- The standard C Git client blocks this via has_dos_drive_prefix, but Dulwich lacks equivalent protection.
- A proof-of-concept script demonstrates creating a malicious repository on Linux that triggers the vulnerability when cloned on Windows.
What to look for
- Unexpected file writes to absolute Windows paths outside the intended worktree during checkout.
Summarised by SecOraLens from GitHub Security Advisories. Always read the original source before acting. How SecOraLens verifies advisories.