Local File Disclosure Vulnerability in GitPython Affects Sensitive File Access

CVE-2026-78675

What is CVE-2026-78675?

GitPython prior to version 3.1.59 contains a vulnerability that allows attackers to exploit improperly configured .gitmodules files. By crafting a malicious .gitmodules file with specific include directives, an attacker can disclose local file contents. When accessing the submodules of a repository, the GitConfigParser can inadvertently raise a MissingSectionHeaderError, which reveals the first line of the targeted sensitive file in the exception message. This issue underscores the importance of proper configuration and validation of include directives in version control settings to prevent unauthorized disclosure of sensitive information.

References