High severity · published May 7, 2026
CVE-2026-44243
GitPython: Path traversal in GitPython reference APIs allows arbitrary file write and delete outside the repository
7.1
CVSS
0.4%
EPSS
No
On KEV
Description
GitPython is a python library used to interact with Git repositories. Prior to version 3.1.48, a vulnerability in GitPython allows attackers who can supply a crafted reference path to an application using GitPython to write, overwrite, move, or delete files outside the repository’s .git directory via insufficient validation of reference paths in reference creation, rename, and delete operations. This issue has been patched in version 3.1.48.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 36% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GI
GitPython · gitpython-developers
< 3.1.48 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-44243
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-44243
Patch
https://github.com/gitpython-developers/GitPython/releases/tag/3.1.48
Exploit
https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-7545-fcxq-7j24
More from GitPython
9.8
CVE-2026-78676
GitPython before 3.1.59 Remote Code Execution via Config Injection
9.8
CVE-2026-67324
GitPython 3.1.50 Authentication Bypass via Joined Short Options
9.8
CVE-2026-42284
GitPython: Unsafe option check validates multi_options before shlex.split transforms it
8.8
CVE-2026-87817
GitPython before 3.1.60 Remote Code Execution via Git Directory Impersonation
8.8
CVE-2026-76221
GitPython before 3.1.58 Config Injection via option-name