Path Traversal in Jelmer Dulwich

CVE-2026-52726

Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.23.2 and prior to version 1.2.5, `dulwich.porcelain.submodule_update`, and by extension `porcelain.clone(..., recurse_submodules=True)`, materializes attacker-controlled submodule paths from a crafted upstream repository without path validation. A malicious `.gitmodules` plus a matching tree gitlink whose `path` is `.git/hooks` (or any other directory inside the parent repository's `.git` directory) causes the attacker's submodule tree contents to be written directly into the victim's `.git/hooks/` directory, preserving executable mode bits. The dropped executables are then run by any subsequent `git` or `dulwich` command that invokes the matching hook, resulting in arbitrary code execution. This is the dulwich equivalent of the upstream Git fixes for CVE-2024-32002 / CVE-2024-32004, which were never propagated into dulwich's separately implemented submodule porcelain. Version 1.2.5 patches the issue.

Vulnerability class: Path Traversal (Directory Traversal)

Published · last modified .

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

EPSS exploit prediction

EPSS: 0.007 (50.5th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 50th percentile — 50.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2026-52726: held from 0.004 to 0.007.

EPSS over last 30 days · oldest: 0.004 · newest: 0.007 · change: +0.002

Affected products

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-52726?
CVE-2026-52726 is a high-severity vulnerability in Jelmer Dulwich, classified under Path Traversal. CVSS score: 7.5/10. Published 2026-06-10.
How severe is CVE-2026-52726?
High severity. CVSS v3 base score is 7.5 out of 10.