CVE-2026-44243

EUVD-2026-28413

07.05.2026, 19:16

GitPython is a python library used to interact with Git repositories. Prior to version 3.1.48, a vulnerability in GitPython allows attackers who can supply a crafted reference path to an application using GitPython to write, overwrite, move, or delete files outside the repository’s .git directory via insufficient validation of reference paths in reference creation, rename, and delete operations. This issue has been patched in version 3.1.48.

Path Traversal

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.1 HIGH	LOCAL	LOW	LOW	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 34.52%

Affected Products (NVD)

Vendor	Product	Version
gitpython_project	gitpython	𝑥 < 3.1.48

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

python-git

bookworm	vulnerable
bullseye	vulnerable
bullseye (security)	vulnerable
forky	3.1.50-1 fixed
sid	3.1.50-1 fixed
trixie	no-dsa

Ubuntu Releases

Ubuntu Product

Codename

python-git

bionic	Fixed 2.1.8-1ubuntu0.1~esm4 released
focal	Fixed 3.0.7-1ubuntu0.1~esm4 released
jammy	Fixed 3.1.24-1ubuntu0.1~esm3 released
noble	Fixed 3.1.37-3ubuntu0.1~esm2 released
questing	ignored
resolute	Fixed 3.1.46-1ubuntu0.1~esm1 released
trusty	Fixed 0.3.2~RC1-3ubuntu0.1~esm3 released
xenial	ignored

Known Exploits!

Common Weakness Enumeration

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References

https://github.com/gitpython-developers/GitPython/releases/tag/3.1.48

https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-7545-fcxq-7j24