Path traversal in GitPython - CVE-2026-44243
Published: April 28, 2026
Vulnerability identifier: #VU128348
CSH Severity: Low
CVSS v4: 7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-44243
CWE-ID: CWE-22
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to write, overwrite, move, or delete files outside the repository's .git directory.
The vulnerability exists due to path traversal in GitPython reference APIs when processing application-controlled reference paths in reference creation, rename, and delete operations. A local user can supply a crafted reference path to write, overwrite, move, or delete files outside the repository's .git directory.
Exploitation requires the ability to influence reference names supplied by the consuming application.
Affected software
GitPython
Ubuntu
openEuler
python-git (Ubuntu package)
python-GitPython
python-GitPython-help
python3-GitPython
Ubuntu
openEuler
python-git (Ubuntu package)
python-GitPython
python-GitPython-help
python3-GitPython
How to mitigate CVE-2026-44243
Install security update from vendor's website.
GitPython - update to 3.1.48
python-git (Ubuntu package) - addressed in versions 0.3.2~RC1-3ubuntu0.1~esm3, 1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm4, 2.1.8-1ubuntu0.1~esm4, 3.0.7-1ubuntu0.1~esm4, 3.1.24-1ubuntu0.1~esm3, 3.1.37-3ubuntu0.1~esm2, 3.1.46-1ubuntu0.1~esm1
python-GitPython - update to 3.1.49-1
python-GitPython-help - update to 3.1.49-1
python3-GitPython - update to 3.1.49-1
python-git (Ubuntu package) - addressed in versions 0.3.2~RC1-3ubuntu0.1~esm3, 1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm4, 2.1.8-1ubuntu0.1~esm4, 3.0.7-1ubuntu0.1~esm4, 3.1.24-1ubuntu0.1~esm3, 3.1.37-3ubuntu0.1~esm2, 3.1.46-1ubuntu0.1~esm1
python-GitPython - update to 3.1.49-1
python-GitPython-help - update to 3.1.49-1
python3-GitPython - update to 3.1.49-1