Path traversal in GitPython - #VU140975
Published: August 5, 2026
Vulnerability identifier: #VU140975
CSH Severity: High
CVSS v4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to create arbitrary Git repositories outside the working tree.
The vulnerability exists due to path traversal in submodule initialization logic when processing a cloned repository's .gitmodules submodule name during submodule initialization. A remote attacker can supply a specially crafted repository with a traversal string in the submodule name to create arbitrary Git repositories outside the working tree.
User interaction is required to clone the malicious repository and run submodule initialization.
Affected software
GitPython
Remediation
Install security update from vendor's website.
GitPython - update to 3.1.58