SB2026042875 - Path traversal in GitPython
Published: April 28, 2026
Security Bulletin ID
SB2026042875
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Path traversal (CVE-ID: N/A)
The vulnerability allows a local user to write, overwrite, move, or delete files outside the repository's .git directory.
The vulnerability exists due to path traversal in GitPython reference APIs when processing application-controlled reference paths in reference creation, rename, and delete operations. A local user can supply a crafted reference path to write, overwrite, move, or delete files outside the repository's .git directory.
Exploitation requires the ability to influence reference names supplied by the consuming application.
Remediation
Install update from vendor's website.