Vulnerability · Published May 7, 2026 · Assigned by GitHub_M
CVE-2026-44243GitPython: Path traversal in GitPython reference APIs allows arbitrary file write and delete outside the repository
High 7.8
In plain English
A high-severity path traversal in GitPython from gitpython-developers. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
GitPython is a python library used to interact with Git repositories. Prior to version 3.1.48, a vulnerability in GitPython allows attackers who can supply a crafted reference path to an application using GitPython to write, overwrite, move, or delete files outside the repository’s .git directory via insufficient validation of reference paths in reference creation, rename, and delete operations. This issue has been patched in version 3.1.48.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | python-git | 3.1.30-1+deb12u3 | DEBIAN-CVE-2026-44243 |
| Debian:13 | python-git | 3.1.44-1+deb13u1 | DEBIAN-CVE-2026-44243 |
| Debian:14 | python-git | 3.1.50-1 | DEBIAN-CVE-2026-44243 |
| PyPI | gitpython | 3.1.48 | PYSEC-2026-2162 |
| PyPI | gitpython | 3.1.48 | GHSA-7545-fcxq-7j24 |
| Ubuntu:25.10 | python-git | no fix listed | UBUNTU-CVE-2026-44243 |
| Ubuntu:26.10 | python-git | no fix listed | UBUNTU-CVE-2026-44243 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| gitpython-developers | GitPython | < 3.1.48 |
Weakness: CWE-22 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:P