Exploitation ongoing with high activity in latest observed window (1 mentions)
Recommended action window: Immediate (within 24h)
NVD description
Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.23.2 and prior to version 1.2.5, `dulwich.porcelain.submodule_update`, and by extension `porcelain.clone(..., recurse_submodules=True)`, materializes attacker-controlled submodule paths from a crafted upstream repository without path validation. A malicious `.gitmodules` plus a matching tree gitlink whose `path` is `.git/hooks` (or any other directory inside the parent repository's `.git` directory) causes the attacker's submodule tree contents to be written directly into the victim's `.git/hooks/` directory, preserving executable mode bits. The dropped executables are then run by any subsequent `git` or `dulwich` command that invokes the matching hook, resulting in arbitrary code execution. This is the dulwich equivalent of the upstream Git fixes for CVE-2024-32002 / CVE-2024-32004, which were never propagated into dulwich's separately implemented submodule porcelain. Version 1.2.5 patches the issue.
Priority
MEDIUM
Exploitation
ACTIVE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-06-11 | 2 | Active Exploitation1Disclosure1 |
| 2026-10-02 | 1 | Disclosure1 |
🔴 Dulwich, Symlink Directory Traversal, #CVE-2026-52726 (High) -DC-Oct2026-2705 https://dailycve.com/dulwich-symlink-directory-traversal-cve-2026-52726-high-dc-oct2026-2705/
Post summary
The post discloses CVE-2026-52726, a High-severity Symlink Directory Traversal in Dulwich, without referencing PoCs, exploits, active attacks, or remediation.
🔴 CVE-2026-52726 is being exploited for RCE: attackers can drop malicious `.git/hooks` payloads via Dulwich's submodule path traversal flaw. This bypasses standard protections. Patch immediately to prevent full compromise. #NerdieNews #CyberSecurity #Vulnerability https://t.co/tIoG1l3nqd
Post summary
CVE-2026-52726 is actively exploited via a path traversal flaw in Dulwich, enabling RCE through malicious .git/hooks payloads, and a patch is urged.
CVE-2026-52726 Arbitrary Code Execution via Malicious Submodule Paths in Dulwich Below 1.2.5 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-52726
Post summary
The entry discloses CVE-2026-52726 as an arbitrary code execution vulnerability in Dulwich versions below 1.2.5, but does not provide PoC, exploit, active exploitation, or patch details.