CVE-2026-44243 Details
Description
GitPython is a python library used to interact with Git repositories. Prior to version 3.1.48, a vulnerability in GitPython allows attackers who can supply a crafted reference path to an application using GitPython to write, overwrite, move, or delete files outside the repository’s .git directory via insufficient validation of reference paths in reference creation, rename, and delete operations. This issue has been patched in version 3.1.48.
A path traversal vulnerability has been identified in GitPython, a Python library for interacting with Git repositories. This vulnerability, present in versions through 3.1.47, allows attackers to manipulate reference paths and perform unauthorized file operations outside the repository's .git directory. The issue arises from inadequate validation of reference paths during creation, renaming, and deletion processes. Exploitation can lead to overwriting, moving, or deleting files, potentially disrupting application state or causing denial-of-service by targeting critical files.
Users can upgrade to GitPython version 3.1.48 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-7545-fcxq-7j24 | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/gitpython-developers/GitPython/releases/tag/3.1.48 | [email protected] | PatchRelease Notes |
| https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-7545-fcxq-7j24 | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| gitpython project gitpython | < 3.1.48 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 7, 2026 | Initial Analysis | [email protected] |
| May 7, 2026 | CVE Modified | CISA-ADP |
| May 7, 2026 | New CVE Received | [email protected] |