Dulwich: Symlink write-through in checkout(paths=[]) via raw os.open bypasses all symlink protections
Summary
Dulwich's porcelain.checkout(paths=[...]) code path writes files using raw os.open(file_path, O_WRONLY|O_CREAT|O_TRUNC, mode) followed by f.write(obj.data). This code path does NOT call build_file_from_blob() at all, completely bypassing any symlink protections (including the unreleased d09f8af fix). os.open without O_NOFOLLOW follows symlinks at both the target file and intermediate directories, allowing arbitrary file writes.
Root Cause
At dulwich/porcelain/__init__.py:5661-5675, the checkout(paths=[...]) implementation:
file_path = _checked_worktree_path(r, path)
os.makedirs(os.path.dirname(file_path), exist_ok=True)
flags = os.O_WRONLY | os.O_CREAT | os.O_TRUNC
with os.fdopen(os.open(file_path, flags, mode), "wb") as f:
f.write(obj.data)_checked_worktree_path() (line 601-631) only performs name validation — checking that the path doesn't start with / or \\ and that components pass INVALID_DOTNAMES checks. It performs zero filesystem symlink detection.
Impact
An attacker can craft a malicious repository that, when a victim clones it and runs checkout(paths=[...]), writes attacker-controlled content (with attacker-controlled permissions) to any filesystem location accessible to the user. Writing to .git/hooks/post-checkout achieves RCE on the next git checkout.
Attack Scenario
- Attacker creates a repository where HEAD has
triggeras a symlink (mode 120000, content../../.git/hooks/post-checkout), and tagv1.0hastriggeras an executable file (mode 100755, content#!/bin/sh\nmalicious_payload) - Victim clones the repository — worktree has
trigger→../../.git/hooks/post-checkout(a symlink) - Victim runs
porcelain.checkout(repo, target="v1.0", paths=["trigger"])to restore a specific file from a tag _checked_worktree_path(r, "trigger")passes — name validation only, no symlink checkos.open("trigger", O_WRONLY|O_CREAT|O_TRUNC, 0o755)follows the symlink → opens.git/hooks/post-checkoutfor writingf.write(obj.data)writes the malicious payload to the hook- Next checkout operation triggers the hook → RCE
Suggested Fix
Replace the raw os.open path with a call to build_file_from_blob (once that function is hardened against intermediate symlinks), or add explicit symlink detection: resolve the path with os.path.realpath() and verify it stays within the worktree root before opening.
Reported by zx (Jace)
Betroffene Software
Klicken Sie auf eine Technologie, um alle zugehörigen Schwachstellen anzuzeigen.
| Plattform | Paket | Anfällige Versionen | Behoben in |
|---|---|---|---|
| Python (PyPI) | dulwich | >= 0.24.0, < 1.2.8 | 1.2.8 |
Verweise
- CVSS-Vektor
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H- Schwäche (CWE)
CWE-59, CWE-61- Plattform
- Python (PyPI)
- Paket
dulwich- Veröffentlicht
- 02.10.2026
- Aktualisiert
- 21.10.2026 14:17
Quellen und Lizenzen
OSV / GitHub Advisory Database - GHSA-8w8g-wq8h-fq33 - CC BY 4.0
Schwachstellenhistorie: dulwich
Alle veröffentlichten Schwachstellen dieses Pakets (Python (PyPI)), neueste zuerst. Zeigt, ob es ein einmaliger Ausrutscher ist oder ein Paket, das man im Auge behalten muss.
- Einträge insgesamt
- 13
- Erste → letzte
- 03.2015 10.2026
- Ohne Fix
- 0
- In Angriffen ausgenutzt
- 0
Verteilung nach Schweregrad
- Kritisch 3
- Hoch 7
- Mittel 2
- Niedrig 1
Veröffentlichungen pro Jahr
- 2017: 1
- 2018: 0
- 2019: 0
- 2020: 0
- 2021: 0
- 2022: 0
- 2023: 0
- 2024: 0
- 2025: 0
- 2026: 10
früher: 2
-
Dulwich: Symlink write-through in checkout(paths=[]) via raw os.open bypasses all symlink protections dieser Eintrag
Erkennen Sie Schwachstellen in Ihrer Anwendung
Mit der DockRay-Integration und aktivierter Softwareinventarisierung prüft DockRay gemeldete Komponentenversionen auf bekannte Schwachstellen und benachrichtigt Sie über bestätigte Treffer. Die Abdeckung hängt von der unterstützten Technologie und den verfügbaren Meldungen ab.