Insufficient Path Validation in GitPython Affects File Security
CVE-2026-44243

7.8HIGH

Key Information:

Vendor

Gitpython-developers

Status
Gitpython
Vendor
CVE Published:
7 May 2026

What is CVE-2026-44243?

A vulnerability in GitPython, a Python library for interacting with Git repositories, allows attackers to manipulate file operations. By supplying a specially crafted reference path, attackers can perform unauthorized actions such as writing, overwriting, moving, or deleting files outside of the designated .git directory. This issue arises from insufficient validation of reference paths during creation, renaming, and deletion processes. A fix was implemented in version 3.1.48 to address this critical security flaw.

Affected Version(s)

GitPython < 3.1.48

References

https://github.com/gitpython-developers/GitPython/securit...
x_refsource_CONFIRM
https://github.com/gitpython-developers/GitPython/release...
x_refsource_MISC

CVSS V4

Score:
7.8
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.