The vulnerability in Dulwich's stash.py pop() allows an attacker to construct a malicious repository that, when the stash is popped, writes files outside the normal working tree by following intermediate symlinks. This path traversal can be used to place arbitrary content such as a malicious post‑checkout hook, which executes code whenever a checkout occurs in that repository. The flaw directly undermines the confidentiality and integrity of the system where the repository is used, potentially allowing code execution on the next checkout operation.

Versions of Dulwich from 0.22.5 up to but not including 1.2.8 are affected. The vulnerability applies to installations managed by the Jelmer Dulwich project. Upgrading to Dulwich 1.2.8 or later removes the flaw.

The CVSS score of 7.3 indicates moderate to high severity, and the EPSS score is reported as < 1%, meaning zero‑day exploitation probability is very low at present. The vulnerability is not listed in the CISA KEV catalog, which suggests it has not yet been widely exploited. Attackers who can supply a malicious repository with a stash containing symlinks that traverse outside the repository can utilise this weakness via the stash pop operation. Successful exploitation would allow an attacker to write a Git hook and achieve code execution in the environment where the repository is used.