CVE-2026-44243CWE-22

GitPython: Path traversal in GitPython reference APIs allows arbitrary file write and delete outside the repository

High · published May 7, 2026

CVSS v4.0
7.8
EPSS
0%
Percentile
37.6
In the wild
Unconfirmed
What it is

GitPython is a python library used to interact with Git repositories. Prior to version 3.1.48, a vulnerability in GitPython allows attackers who can supply a crafted reference path to an application using GitPython to write, overwrite, move, or delete files outside the repository’s .git directory via insufficient validation of reference paths in reference creation, rename, and delete operations. This issue has been patched in version 3.1.48.

The record
Technical detail
CVSS v4.0
7.8 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
EPSS
0.00443 · 37.6th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-05-07T18:22Z
EPSS history
Timeline
  • 07 MAY 18:22Z
    GitPython: Path traversal in GitPython reference APIs allows arbitrary file write and delete outside the repository
    cvelistv5