Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.24.0 and prior to version 1.2.5, dulwich.porcelain.format_patch(outdir=...) derives each patch filename from the commit's subject line. Prior to this fix, get_summary only replaced spaces with dashes - path separators (/, \), parent-directory components (..), and other filename-hostile characters (e.g. :) were preserved verbatim and passed straight into os.path.join(outdir, f"{i:04d}-{summary}.patch"). A malicious commit subject could therefore direct the generated patch file outside the requested outdir. This is fixed in Dulwich 1.2.5. Users should upgrade to 1.2.5 or later. dulwich.patch.get_summary now mirrors git's format_sanitized_subject: only `[A-Za-z0-9._]` are kept, runs of other characters collapse to a single -, consecutive . collapse to a single ., trailing ./- are stripped, and the result is length-limited. This makes the returned string safe to embed as a filename component, so format_patch can no longer be steered out of outdir via the commit subject. Until upgrading, callers that pass untrusted commits to porcelain.format_patch can use stdout=True and write the patch to a destination they control, rather than letting format_patch choose the filename; validate the chosen path before opening - e.g. compare os.path.realpath(returned_path) against os.path.realpath(outdir) and reject any patch whose resolved path is not inside outdir; and/or pre-screen commits and refuse to format any whose subject's first line contains /, \, .., or other characters that are not safe on the target filesystem.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.24.0
    and prior to version 1.2.5, dulwich.porcelain.format_patch(outdir=...) derives each patch filename from
    the commit's subject line. Prior to this fix, get_summary only replaced spaces with dashes - path
    separators (/, \), parent-directory components (..), and other filename-hostile characters (e.g. :) were
    preserved verbatim and passed straight into os.path.join(outdir, f"{i:04d}-{summary}.patch"). A malicious
    commit subject could therefore direct the generated patch file outside the requested outdir. This is fixed
    in Dulwich 1.2.5. Users should upgrade to 1.2.5 or later. dulwich.patch.get_summary now mirrors git's
    format_sanitized_subject: only `[A-Za-z0-9._]` are kept, runs of other characters collapse to a single -,
    consecutive . collapse to a single ., trailing ./- are stripped, and the result is length-limited. This
    makes the returned string safe to embed as a filename component, so format_patch can no longer be steered
    out of outdir via the commit subject. Until upgrading, callers that pass untrusted commits to
    porcelain.format_patch can use stdout=True and write the patch to a destination they control, rather than
    letting format_patch choose the filename; validate the chosen path before opening - e.g. compare
    os.path.realpath(returned_path) against os.path.realpath(outdir) and reject any patch whose resolved path
    is not inside outdir; and/or pre-screen commits and refuse to format any whose subject's first line
    contains /, \, .., or other characters that are not safe on the target filesystem. (CVE-2026-47712)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-fbd55e52fb advisory.

    1.2.9, CVE fixes

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.24.0     and prior to version 1.2.5, dulwich.porcelain.format_patch(outdir=...) derives each patch filename from     the commit's subject line. Prior to this fix, get_summary only replaced spaces with dashes - path     separators (/, \), parent-directory components (..), and other filename-hostile characters (e.g. :) were     preserved verbatim and passed straight into os.path.join(outdir, f{i:04d}-{summary}.patch). A malicious     commit subject could therefore direct the generated patch file outside the requested outdir. This is fixed     in Dulwich 1.2.5. Users should upgrade to 1.2.5 or later. dulwich.patch.get_summary now mirrors git's     format_sanitized_subject: only `[A-Za-z0-9._]` are kept, runs of other characters collapse to a single -,     consecutive . collapse to a single ., trailing ./- are stripped, and the result is length-limited. This     makes the returned string safe to embed as a filename component, so format_patch can no longer be steered     out of outdir via the commit subject. Until upgrading, callers that pass untrusted commits to     porcelain.format_patch can use stdout=True and write the patch to a destination they control, rather than     letting format_patch choose the filename; validate the chosen path before opening - e.g. compare     os.path.realpath(returned_path) against os.path.realpath(outdir) and reject any patch whose resolved path     is not inside outdir; and/or pre-screen commits and refuse to format any whose subject's first line     contains /, \, .., or other characters that are not safe on the target filesystem. (CVE-2026-47712)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
461925	Echo: dulwich: security update to 1.2.5	Tenable Cloud Security	Echo Local Security Checks	Local	low
461925	Echo: dulwich: security update to 1.2.5	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	low
326391	Fedora 44 : python-dulwich (2026-fbd55e52fb)	Nessus	Fedora Local Security Checks	Local	high
443088	SCA: security update for dulwich (GHSA-555p-6grf-mh7f)	Tenable Cloud Security	SCA Checks	Local	low
443088	SCA: security update for dulwich (GHSA-555p-6grf-mh7f)	Tenable Self-Hosted Container Security	SCA Checks	Local	low
317717	Linux Distros Unpatched Vulnerability : CVE-2026-47712	Nessus	Misc.	Local	low

Detections

Analytics

CVE-2026-47712

low

Tenable Plugins

low

low

high

low

low

low