{"id":"AZL-109890","summary":"CVE-2026-114094 affecting package python-dulwich 0.21.7-6","details":"Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrary file write. Attackers can craft a malicious repository with a tree entry named 'C:' that bypasses NTFS validation and writes files outside the worktree to achieve remote code execution.","modified":"2026-10-23T14:17:03.266997682Z","published":"2026-10-21T01:17:34Z","upstream":["CVE-2026-114094"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114094"}],"affected":[{"package":{"name":"python-dulwich","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/python-dulwich"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.21.7-6"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-109890.json"}}],"schema_version":"1.9.0"}