CVE-2026-44243
GitPython: Path traversal in GitPython reference APIs allows arbitrary file write and delete outside the repository
Vexday Risk Score
21Bajo
Decisión SSVC (CISA)
Track
Sin señal de explotación → monitorear
CVSS 7.8EPSS 0.4%KEV nãoPoC —Nuclei —Metasploit —Patch —
Ciclo de vida
07 may 2026Publicada en NVD
Recomendación: Monitorear — sin señal de explotación por ahora.
GitPython is a python library used to interact with Git repositories. Prior to version 3.1.48, a vulnerability in GitPython allows attackers who can supply a crafted reference path to an application using GitPython to write, overwrite, move, or delete files outside the repository’s .git directory via insufficient validation of reference paths in reference creation, rename, and delete operations. This issue has been patched in version 3.1.48.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Productos afectados
gitpython-developers · GitPython¿Quieres saber si tu infraestructura está expuesta a esto?
Hablar con TrueHacking →