Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is a classic path traversal issue (CWE-22) within the dulwich library. The core of the issue was in the dulwich.patch.get_summary function, which was tasked with creating a filename from a commit's subject line. The function's implementation was naive, only replacing spaces with dashes and failing to strip or escape directory traversal sequences (../, ..\\) and other filesystem-hostile characters.
The user-facing API dulwich.porcelain.format_patch uses the output of get_summary to construct the full path for the generated patch file. By crafting a commit with a malicious subject line like x/../../x, an attacker could cause format_patch to write a file outside of the intended output directory, leading to arbitrary file creation within the write permissions of the process.
The patch resolves this by completely rewriting get_summary to use a new helper function, _sanitize_subject_for_filename. This new implementation mirrors Git's own sanitization logic, creating a whitelist of safe characters ([A-Za-z0-9._]), collapsing unsafe character sequences into a single dash, and truncating the result. This ensures that any commit subject, no matter how malicious, is converted into a safe filename component before being used in a path.
get_summarydulwich/patch.py
format_patchdulwich/porcelain.py
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| dulwich | pip | >= 0.24.0, < 1.2.5 | 1.2.5 |