Dulwich before version 1.2.9 fails to validate DOS drive letter prefixes in Git tree paths when running on Windows, permitting a malicious repository to write files outside the intended worktree. This is a CWE-22 weakness. The vulnerability allows an attacker to place a tree entry named "C:" that bypasses NTFS validation, resulting in arbitrary file writes and ultimately remote code execution on the host system.

The issue affects all installations of Dulwich by the Dulwich project using any version prior to 1.2.9 when executed on Windows. Users of earlier releases who clone or pull vulnerable repositories are at risk.

The CVSS score of 8.7 classifies this as a high severity flaw. The EPSS score of less than 1% indicates a low current likelihood of exploitation, and the vulnerability is not yet listed in CISA KEV. Nonetheless, the attack vector is inferred to involve the delivery of a specially crafted repository to a Windows machine where Dulwich is used. The exploit requires only the ability to form or host the repository, and the ensuing file write can overwrite critical system files if file permissions permit, enabling full remote code execution.