Dulwich: Symlink write-through in checkout(paths=[]) via raw os.open bypasses all symlink protections
Summary
Dulwich's porcelain.checkout(paths=[...]) code path writes files using raw os.open(file_path, O_WRONLY|O_CREAT|O_TRUNC, mode) followed by f.write(obj.data). This code path does NOT call build_file_from_blob() at all, completely bypassing any symlink protections (including the unreleased d09f8af fix). os.open without O_NOFOLLOW follows symlinks at both the target file and intermediate directories, allowing arbitrary file writes.
Root Cause
At dulwich/porcelain/__init__.py:5661-5675, the checkout(paths=[...]) implementation:
file_path = _checked_worktree_path(r, path)
os.makedirs(os.path.dirname(file_path), exist_ok=True)
flags = os.O_WRONLY | os.O_CREAT | os.O_TRUNC
with os.fdopen(os.open(file_path, flags, mode), "wb") as f:
f.write(obj.data)_checked_worktree_path() (line 601-631) only performs name validation — checking that the path doesn't start with / or \\ and that components pass INVALID_DOTNAMES checks. It performs zero filesystem symlink detection.
Impact
An attacker can craft a malicious repository that, when a victim clones it and runs checkout(paths=[...]), writes attacker-controlled content (with attacker-controlled permissions) to any filesystem location accessible to the user. Writing to .git/hooks/post-checkout achieves RCE on the next git checkout.
Attack Scenario
- Attacker creates a repository where HEAD has
triggeras a symlink (mode 120000, content../../.git/hooks/post-checkout), and tagv1.0hastriggeras an executable file (mode 100755, content#!/bin/sh\nmalicious_payload) - Victim clones the repository — worktree has
trigger→../../.git/hooks/post-checkout(a symlink) - Victim runs
porcelain.checkout(repo, target="v1.0", paths=["trigger"])to restore a specific file from a tag _checked_worktree_path(r, "trigger")passes — name validation only, no symlink checkos.open("trigger", O_WRONLY|O_CREAT|O_TRUNC, 0o755)follows the symlink → opens.git/hooks/post-checkoutfor writingf.write(obj.data)writes the malicious payload to the hook- Next checkout operation triggers the hook → RCE
Suggested Fix
Replace the raw os.open path with a call to build_file_from_blob (once that function is hardened against intermediate symlinks), or add explicit symlink detection: resolve the path with os.path.realpath() and verify it stays within the worktree root before opening.
Reported by zx (Jace)
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Python (PyPI) | dulwich | >= 0.24.0, < 1.2.8 | 1.2.8 |
Referencias
- Vector CVSS
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H- Debilidad (CWE)
CWE-59, CWE-61- Plataforma
- Python (PyPI)
- Paquete
dulwich- Publicada
- 02.10.2026
- Actualizado
- 21.10.2026 14:17
Fuentes y licencias
OSV / GitHub Advisory Database - GHSA-8w8g-wq8h-fq33 - CC BY 4.0
Historial de vulnerabilidades: dulwich
Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 13
- Primera → última
- 03.2015 10.2026
- Sin corrección
- 0
- Explotada en ataques
- 0
Distribución por gravedad
- Crítica 3
- Alta 7
- Media 2
- Baja 1
Divulgaciones por año
- 2017: 1
- 2018: 0
- 2019: 0
- 2020: 0
- 2021: 0
- 2022: 0
- 2023: 0
- 2024: 0
- 2025: 0
- 2026: 10
antes: 2
-
Dulwich: Symlink write-through in checkout(paths=[]) via raw os.open bypasses all symlink protections esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.