CVE-2026-73619CWE-73

CVE-2026-73619

Medium · published August 13, 2026

CVSS v3.1

6.5

EPSS

Percentile

34.3

In the wild

Unconfirmed

What it is

GitPython before 3.1.57 contains an incomplete denylist in the unsafe_git_archive_options guard that omits --add-file and --add-virtual-file options. Attackers can supply these options to Repo.archive() to read arbitrary files from the filesystem and include them in the returned archive.

The record

Technical detail

CVSS v3.1: 6.5 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.00412 · 34.3th percentile
Weakness: CWE-73 · External Control of File Name or Path
Published: 2026-08-13T16:17Z

Affected products (1)

Product	Versions	Fixed in
gitpython_project/gitpython	< 3.1.57	3.1.57

References (3)

https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-539m-9xh6-q6rr · [email protected]https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-read-via-repo-archive · [email protected]https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-539m-9xh6-q6rr · 134c704f-9b21-4f2e-91b3-4a467353bcc0

EPSS history

Timeline

13 AUG 11:28Z
GitPython before 3.1.57 Arbitrary File Read via Repo.archive()
cvelistv5