CVE-2026-52726 is a high-severity path traversal vulnerability in dulwich (pip), affecting versions >= 0.23.2, < 1.2.5. It is fixed in 1.2.5.
Summary dulwich.porcelain.submoduleupdate, and by extension porcelain.clone(..., recursesubmodules=True), materializes attacker-controlled submodule paths from a crafted upstream repository without path validation. A malicious .gitmodules plus a matching tree gitlink whose path is .git/hooks (or any other directory inside the parent repository's .git directory) causes the attacker's submodule tree contents to be written directly into the victim's .git/hooks/ directory, preserving executable mode bits. The dropped executables are then run by any subsequent git or dulwich command that invokes the matching hook, resulting in arbitrary code execution. This is the dulwich equivalent of the upstream Git fixes for CVE-2024-32002 / CVE-2024-32004, which were never propagated into dulwich's separately implemented submodule porcelain. Affected Package: dulwich (PyPI) Affected versions: >=0.23.2, <1.2.5 Affected platforms: all (Linux, macOS, Windows). Exploitation does not require a case-insensitive or NTFS filesystem, because the path written is a literal .git/hooks rather than a case- or short-name-aliased form. Affected entry points: dulwich.porcelain.submoduleupdate(repo, init=True, recursive=True) dulwich.porcelain.clone(source, target, recursesubmodules=True) dulwich submodule update CLI / dulwich clone --recurse-submodules CLI Vulnerable code The submodule path from the tree's gitlink entry (and matching .gitmodules) is consumed without validation in dulwich/porcelain/submodule.py. The attacker-controlled path enters the loop from itercachedsubmodules (submodule.py#L154-L168): It flows unchecked into os.path.join and the filesystem (submodule.py#L187-L188): Finally, the attacker tree's contents are materialized into that directory via buildindexfromtree with no validatepathelement argument, defaulting to the lax validator (submodule.py#L229-L234): Three issues compound: pathstr originates from the parent repository's tree gitlink entry (attacker-controlled) and is never validated against .git, .., or other path-traversal patterns. The same value is read from the attacker-supplied .gitmodules blob via readsubmodules, which also performs no validation. submodulepath = os.path.join(r.path, pathstr) therefore resolves to an attacker-chosen directory anywhere on disk (e.g. <worktree>/.git/hooks). buildindexfromtree is called without validatepathelement, so it defaults to validatepathelementdefault, which only rejects literal .git, ., and ... It does not refuse a rootpath that is itself inside the parent's .git directory, and it honors the attacker tree's file modes including executable bits (0o100755). Reachability A direct production call path from a user invocation: porcelain.clone(source, target, recursesubmodules=True) at dulwich/porcelain/init.py:1548-1551 calls submoduleupdate(repo, init=True, recursive=True) once the parent clone completes, reaching the unsanitized loop at submodule.py#L154-L234. The CLI command dulwich clone --recurse-submodules <url> reaches the same sink via dulwich/cli.py:2131. Any service that exposes porcelain.clone(..., recurse_submodules=True) on attacker-supplied URLs is exposed: CI runners, repository import tools, package resolvers that use dulwich as a pure-Python git, and language-server "fetch dependency from git" features. Proof of concept End-to-end against pip-installed dulwich==1.2.4, demonstrating both the path-traversal primitive and the resulting code execution when the victim subsequently runs git. The payload writes a marker file rather than performing any destructive action. The trigger surface is broader than this proof of concept: the dropped file fires for any matching hook name (post-checkout, pre-commit, post-merge, post-rewrite, post-applypatch, and others). dulwich itself executes several hooks (pre-commit, commit-msg, post-commit, pre-receive, update, post-receive; see dulwich/hooks.py and dulwich/repo.py), so a victim using only dulwich is also reachable without upstream Git. Credit tonghuaroot
Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files. Typical impact: unauthorized file read or write outside the intended directory.
CVE-2026-52726 has a CVSS score of 7.5 (High). The vector is network-reachable, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment.
A fixed version is available (1.2.5). Upgrading removes the vulnerable code path.
pip
dulwich (>= 0.23.2, < 1.2.5)dulwich → 1.2.5 (pip)Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter instead of chasing every advisory.
Kodem's runtime-powered SCA identifies whether CVE-2026-52726 is reachable in your applications. Explore open-source security for your team.
See if CVE-2026-52726 is reachable in your applications. Get a demo
Already deployed Kodem? See CVE-2026-52726 in your environment →Upgrade dulwich to 1.2.5 or later to resolve this vulnerability.
Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.
CVE-2026-52726 is a high-severity path traversal vulnerability in dulwich (pip), affecting versions >= 0.23.2, < 1.2.5. It is fixed in 1.2.5. Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files.
CVE-2026-52726 has a CVSS score of 7.5 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
dulwich (pip) versions >= 0.23.2, < 1.2.5 is affected.
Yes. CVE-2026-52726 is fixed in 1.2.5. Upgrade to this version or later.
Whether CVE-2026-52726 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
Upgrade dulwich to 1.2.5 or later.