CVE-2026-44243 HIGH

CVE-2026-44243: GitPython: Path traversal in GitPython reference APIs allows arbitrary file write and delete outside the repository

Vendor Gitpython-Developers

Product GitPython

Weakness CWE-22 · Path traversal

Published May 7, 2026

Last update May 7, 2026

View on NVD All CVEs

CVSS base score

7.8/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

What the vulnerability does

Description

GitPython is a python library used to interact with Git repositories. Prior to version 3.1.48, a vulnerability in GitPython allows attackers who can supply a crafted reference path to an application using GitPython to write, overwrite, move, or delete files outside the repository’s .git directory via insufficient validation of reference paths in reference creation, rename, and delete operations. This issue has been patched in version 3.1.48.

Key dates

Disclosure timeline

May 7, 2026 CVE published

May 7, 2026 Record updated