CVE-2026-44243
HIGHGitPython: Path traversal in GitPython reference APIs allows arbitrary file write and delete outside the repository
Title source: cnaDescription
GitPython is a python library used to interact with Git repositories. Prior to version 3.1.48, a vulnerability in GitPython allows attackers who can supply a crafted reference path to an application using GitPython to write, overwrite, move, or delete files outside the repository’s .git directory via insufficient validation of reference paths in reference creation, rename, and delete operations. This issue has been patched in version 3.1.48.
References (2)
Core 2
Core References
X_Refsource_Confirm x_refsource_confirm
https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-7545-fcxq-7j24
X_Refsource_Misc x_refsource_misc
https://github.com/gitpython-developers/GitPython/releases/tag/3.1.48
Scores
CVSS v3
7.1
EPSS
0.0014
EPSS Percentile
33.4%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
total
Details
CWE
CWE-22
Status
published
Products (3)
gitpython-developers/GitPython
< 3.1.48
gitpython_project/gitpython
< 3.1.48
pypi/GitPython
0 - 3.1.48PyPI
Published
May 07, 2026
Tracked Since
May 08, 2026