What’s Vulnerable › Vulnerabilities

CVE-2026-44243: GitPython: Path traversal in GitPython reference APIs allows arbitrary file write and delete outside the repository

• Severity: high (CVSS 7.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-05-07 · updated 2026-06-17
• Weakness: CWE-22

Description

GitPython is a python library used to interact with Git repositories. Prior to version 3.1.48, a vulnerability in GitPython allows attackers who can supply a crafted reference path to an application using GitPython to write, overwrite, move, or delete files outside the repository’s .git directory via insufficient validation of reference paths in reference creation, rename, and delete operations. This issue has been patched in version 3.1.48.

Affected products

• gitpython-developers GitPython: before 3.1.48 — fixed in 3.1.48

How to fix

Upgrade to a fixed version: gitpython-developers GitPython 3.1.48. Check the vendor advisory for mitigations.

References

• https://github.com/gitpython-developers/GitPython/releases/tag/3.1.48
• https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-7545-fcxq-7j24
• https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-7545-fcxq-7j24

Get alerted when CVE-2026-44243 or the next vulnerability affects your stack