{"id":16564,"date":"2026-09-04T19:05:27","date_gmt":"2026-09-04T11:05:27","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-52726"},"modified":"2026-09-04T19:05:27","modified_gmt":"2026-09-04T11:05:27","slug":"cve-2026-52726","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-52726","title":{"rendered":"CVE-2026-52726 [HIGH] &#8211; Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in"},"content":{"rendered":"<p>Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.23.2 and prior to version 1.2.5, `dulwich.porcelain.submodule_update`, and by extension `porcelain.clone(&#8230;, recurse_submodules=True)`, materializes attacker-controlled submodule paths from a crafted upstream repository without path validation. A malicious `.gitmodules` plus a matching tree gitlink whose `path` is `.git\/hooks` (or any other directory inside the parent repository&#8217;s `.git` directory) causes the attacker&#8217;s submodule tree contents to be written directly into the victim&#8217;s `.git\/hooks\/` directory, preserving executable mode bits. The dropped executables are then run by any subsequent `git` or `dulwich` command that invokes the matching hook, resulting in arbitrary code execution. This is the dulwich equivalent of the upstream Git fixes for CVE-2024-32002 \/ CVE-2024-32004, which were never propagated into dulwich&#8217;s separately implemented submodule porcelain. Version 1.2.5 patches the issue.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.23.2 and prior to version 1.2.5, `dulwich.porcelain.submodule_update`, and by extension `porcelain.<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-16564","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/16564","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=16564"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=16564"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=16564"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}