Dulwich Windows Git Path Flaw Enables Arbitrary File Write and RCE

A high-severity flaw in Dulwich tracked as CVE-2026-42305 allows arbitrary file write and potential remote code execution on Windows when a user clones, fetches, or checks out a malicious Git repository. The bug affects versions 0.10.0 through 1.2.4 and stems from improper validation of tree entry names that Windows interprets as path syntax, including backslashes, NTFS alternate data stream markers, and NTFS 8.3 short-name aliases tied to .git. A crafted repository can write files outside the work tree or place executable content such as .git\hooks\pre-commit.exe inside the victim’s Git metadata, which Git for Windows may later execute in the user’s context.

The project released Dulwich 1.2.5 to fix the issue, correcting mishandled core.protectNTFS and core.protectHFS configuration names, enabling core.protectNTFS by default on all platforms, and tightening checks to block dangerous names including reserved Windows devices like CON, NUL, COM1, and LPT1. Release notes say the update also addresses other security bugs, including unsafe submodule path handling, shell command injection in ProcessMergeDriver, unsafe patch filename generation, and improper receive.maxInputSize enforcement. Maintainers said there is no effective workaround short of upgrading, and warned that even POSIX users can unknowingly propagate malicious trees to Windows users through pushes or republished repositories.