CVE-2026-52726

{
  "id": "CVE-2026-52726",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-52726",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-06-11T12:54:26.026132Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "jelmer",
          "product": "dulwich",
          "versions": [
            {
              "status": "affected",
              "version": ">= 0.23.2, < 1.2.5"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-06-10T23:16:50.143",
  "references": [
    {
      "url": "https://github.com/jelmer/dulwich/releases/tag/dulwich-1.2.5",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/jelmer/dulwich/security/advisories/GHSA-gfhv-vqv2-4544",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/jelmer/dulwich/security/advisories/GHSA-gfhv-vqv2-4544",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.23.2 and prior to version 1.2.5, `dulwich.porcelain.submodule_update`, and by extension `porcelain.clone(..., recurse_submodules=True)`, materializes attacker-controlled submodule paths from a crafted upstream repository without path validation. A malicious `.gitmodules` plus a matching tree gitlink whose `path` is `.git/hooks` (or any other directory inside the parent repository's `.git` directory) causes the attacker's submodule tree contents to be written directly into the victim's `.git/hooks/` directory, preserving executable mode bits. The dropped executables are then run by any subsequent `git` or `dulwich` command that invokes the matching hook, resulting in arbitrary code execution. This is the dulwich equivalent of the upstream Git fixes for CVE-2024-32002 / CVE-2024-32004, which were never propagated into dulwich's separately implemented submodule porcelain. Version 1.2.5 patches the issue."
    },
    {
      "lang": "es",
      "value": "Dulwich es una implementación pura de Python de los formatos de archivo y protocolos de Git. A partir de la versión 0.23.2 y antes de la versión 1.2.5, 'dulwich.porcelain.submodule_update', y por extensión 'porcelain.clone(..., recurse_submodules=True)', materializa rutas de submódulos controladas por el atacante desde un repositorio ascendente manipulado sin validación de ruta. Un archivo '.gitmodules' malicioso más un gitlink de árbol coincidente cuya 'path' es '.git/hooks' (o cualquier otro directorio dentro del directorio '.git' del repositorio padre) hace que el contenido del árbol del submódulo del atacante se escriba directamente en el directorio '.git/hooks/' de la víctima, preservando los bits de modo ejecutable. Los ejecutables soltados son luego ejecutados por cualquier comando 'git' o 'dulwich' subsiguiente que invoca el hook coincidente, resultando en ejecución de código arbitrario. Este es el equivalente en dulwich de las correcciones de Git ascendentes para CVE-2024-32002 / CVE-2024-32004, que nunca se propagaron al 'porcelain' de submódulos implementado por separado de dulwich. La versión 1.2.5 corrige el problema."
    }
  ],
  "lastModified": "2026-07-21T19:10:00.107",
  "sourceIdentifier": "security-advisories@github.com"
}