CVE-2026-76222
GitPython before 3.1.58 Path Traversal via .gitmodules Submodule Name
HIGH 8.4
En bref
- Source
- NVD
- EPSS
- EPSS 0.42 % · centile 36 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- VulnCheck
- Statut NVD
- Analyzed
Description
GitPython before 3.1.58 fails to validate submodule names from .gitmodules files, allowing attackers to create Git repositories at arbitrary filesystem paths outside the intended clone directory. Attackers can craft malicious repositories with traversal sequences in submodule names that GitPython processes during submodule initialization, creating attacker-controlled Git repositories at escaped filesystem locations.
Faiblesses (CWE)
- CWE-22 — Traversée de répertoire
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 4.0 | HIGH 8.4 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L | VulnCheck |
| CVSS 3.1 | HIGH 8.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:L | VulnCheck |
| CVSS 4.0 | HIGH 8.4 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X | NVD · disclosure@vulncheck.com (Secondary) |
| CVSS 3.1 | HIGH 8.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:L | NVD · disclosure@vulncheck.com (Secondary) |
Avis
- GHSA-hmq2-w58f-27jc — GitPython: Arbitrary Git Repository Creation Outside the Working Tree via Unvalidated .gitmodules Submodule Name in GitPython
- PYSEC-2026-3784 — GitPython before 3.1.58 fails to validate submodule names from .gitmodules files, allowing attackers to create Git repositories at arbitrary filesystem paths ou
Références européennes
- ENISA EUVD · EUVD-2026-62463
- GCVE · GCVE-0-2026-76222
Configurations affectées (CPE NVD)
cpe:2.3:a:gitpython_project:gitpython:*:*:*:*:*:python:*:*< 3.1.58
Produits affectés
| Produit | Versions |
|---|---|
| gitpython-developers · GitPython | affected 0 < 3.1.58 ; unaffected 3.1.58 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |