# CVE-2014-9706: Dulwich arbitrary code execution via malicious .git directory paths

Source: https://junglewise.ai/threats/cve-2014-9706-dulwich-arbitrary-code-execution-via-malicious-git-directory-paths  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-05-17. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2014-9706 · Severity: critical · CVSS 9.8 · Published 2022-05-17

Dulwich, a Python implementation of the Git file format and protocols, is vulnerable to a flaw that allows remote attackers to execute arbitrary code. By sending a specially crafted commit containing directory paths starting with '.git/', an attacker can bypass security checks during the checkout process. This could lead to a full system compromise or unauthorized access to sensitive repository data.

Technologies: [dulwich (PyPI)](https://junglewise.ai/threats/technologies/dulwich). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2014-9706 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2014-9706 being exploited in the wild.

**How severe is CVE-2014-9706?** Critical severity, with a CVSS score of 9.8, published 17 May 2022.

**Which products and versions are affected?** dulwich (PyPI) < 0.9.10, ECOSYSTEM:introduced=0,fixed=0.9.10, ECOSYSTEM:introduced=0,fixed=0.9.9.

**Is there a fix for CVE-2014-9706?** Yes. dulwich (PyPI): upgrade to 0.9.10, 0.9.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2014-9706 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2014-9706?** Check whether you run dulwich (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- dulwich (PyPI): upgrade to 0.9.10, 0.9.9 or later

  ```sh
  pip install "dulwich>=0.9.10"
  ```


## Technical details

A vulnerability exists in the 'build_index_from_tree' function within 'index.py' of Dulwich (versions <= 0.9.9). The root cause is improper validation of directory paths during the process of checking out a working tree. Specifically, the library fails to block or safely handle paths starting with '.git/', which allows an attacker to overwrite internal Git metadata or configuration files. A remote attacker can exploit this by providing a malicious commit to a system using Dulwich for Git operations, leading to arbitrary code execution. This issue was addressed in version 0.9.10 by improving path handling logic.

## Affected products

- Jelmer Vernooij dulwich < 0.9.10

## Identifiers

- CVE-2014-9706
- GHSA-4j5j-58j7-6c3w
- PYSEC-2015-34

## Timeline

- 2014-12-18: patched: Fix committed to upstream repository
- 2015-03-31: disclosed: NVD publication date
- 2022-05-17: advisory: GitHub Advisory published

## References

- [https://api.github.com/users/DEVSOG12](https://api.github.com/users/DEVSOG12)
- [https://github.com/DEVSOG12](https://github.com/DEVSOG12)
- [https://api.github.com/users/DEVSOG12/gists%7B/gist_id%7D](https://api.github.com/users/DEVSOG12/gists%7B/gist_id%7D)
- [https://api.github.com/users/DEVSOG12/repos](https://api.github.com/users/DEVSOG12/repos)
- [https://avatars.githubusercontent.com/u/54543298?v=4](https://avatars.githubusercontent.com/u/54543298?v=4)
- [https://api.github.com/users/DEVSOG12/events%7B/privacy%7D](https://api.github.com/users/DEVSOG12/events%7B/privacy%7D)

## Related threats

- [Dulwich arbitrary file write on Windows via unvalidated drive letters](https://junglewise.ai/threats/dulwich-arbitrary-file-write-rce-on-windows-via-unvalidated-drive-fc90311d)
- [Dulwich infinite loop denial of service in packfile object resolution](https://junglewise.ai/threats/dulwich-infinite-loop-denial-of-service-dos-in-packfile-object-d71acec7)
- [Dulwich symlink write-through in checkout via os.open](https://junglewise.ai/threats/dulwich-symlink-write-through-in-checkout-paths-via-raw-os-open-7e9ebad6)
- [Dulwich symlink directory traversal in filter-branch index_filter](https://junglewise.ai/threats/dulwich-symlink-directory-traversal-in-filter-branch-index-filter-via-c34daf58)
- [Dulwich symlink directory traversal in stash pop](https://junglewise.ai/threats/dulwich-symlink-directory-traversal-in-stash-pop-allows-arbitrary-file-12378d39)