CVE-2026-76222CWE-22path-traversal

CVE-2026-76222

High · published August 19, 2026

CVSS v3.1
8.2
EPSS
0%
Percentile
35.4
In the wild
Unconfirmed
What it is

GitPython before 3.1.58 fails to validate submodule names from .gitmodules files, allowing attackers to create Git repositories at arbitrary filesystem paths outside the intended clone directory. Attackers can craft malicious repositories with traversal sequences in submodule names that GitPython processes during submodule initialization, creating attacker-controlled Git repositories at escaped filesystem locations.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:L
CVSS v4.0
8.4 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L
EPSS
0.00422 · 35.4th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-08-19T18:17Z
Affected products (1)
ProductVersionsFixed in
gitpython_project/gitpython< 3.1.583.1.58
References (3)
https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-hmq2-w58f-27jc · [email protected]https://www.vulncheck.com/advisories/gitpython-before-path-traversal-via-gitmodules-submodule-name · [email protected]https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-hmq2-w58f-27jc · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 19 AUG 14:02Z
    GitPython before 3.1.58 Path Traversal via .gitmodules Submodule Name
    cvelistv5