Skip to main content

GitPython EUVDEUVD-2026-87662

| CVE-2026-100689 HIGH
Path Traversal (CWE-22)
2026-09-26 VulnCheck GHSA-cw5h-x3x9-4mwp
Python Path Traversal Canonical Gitpython Gitpython Developers
8.7
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.7 HIGH

Untrusted .gitmodules needs no auth (PR:N) but only the non-default non-HEAD update flow triggers it (AC:H); writes/deletes escape the working tree (S:C) giving I:H/A:H, no read so C:N.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.9 MEDIUM
AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L
Red Hat
5.9 MEDIUM
qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

5
POC Analysis Generated
Sep 26, 2026 - 15:28 vuln.today
Metadata Corrected
Sep 26, 2026 - 14:40 vuln.today
tag: Python added
Analysis Generated
Sep 26, 2026 - 14:19 vuln.today
Patch available
Sep 26, 2026 - 14:02 EUVD
CVE Published
Sep 26, 2026 - 13:23 cve.org
HIGH 8.7

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 332 pypi packages depend on gitpython (159 direct, 176 indirect)

Ecosystem-wide dependent count for version 3.1.62.

DescriptionCVE.org

GitPython before 3.1.62 does not validate the path field read from an untrusted .gitmodules file when updating submodules. While a prior fix (GHSA-hmq2-w58f-27jc) added Submodule._validated_name() to constrain the name field, and GitPython's own containment guard Submodule._to_relative_path() is applied in add() and move(), Submodule.update() derives the absolute checkout location from the raw path value without that guard. A .gitmodules entry containing directory traversal components (e.g., path = ../../../tmp/escaped) can therefore cause directories to be created via os.makedirs() outside the repository working tree, populated from the submodule URL on the clone path, and removed via shutil.rmtree() when force_remove is used. Exploitation requires an application flow that updates submodules at a non-HEAD commit (such as a historical-commit API); the common clone-then-update flow re-derives the path from a canonical tree lookup and is not affected. The issue is fixed in GitPython 3.1.62.

Articles & Coverage 1

News 15 New Python Vulnerabilities - 15 High Severity, None With POC Sep 27, 2026

AnalysisAI

GitPython before 3.1.62 is vulnerable to a path traversal (CWE-22) in Submodule.update() that allows unauthenticated remote attackers to create, populate from a submodule URL, and potentially delete directories outside the repository working tree when an application updates submodules at a non-HEAD (historical) commit. The flaw stems from the path field in an untrusted .gitmodules file being used without the _to_relative_path() containment guard that is applied in add() and move(). …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires the affected application to invoke Submodule.update() while checking out submodules at a NON-HEAD (historical) commit - for example a historical-commit browsing/API feature - because only that flow derives the checkout location from the raw untrusted `path` in .gitmodules; the ordinary clone-then-update flow re-derives the path from a canonical tree lookup and is NOT vulnerable. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment This is a genuine but conditionally-exploitable path traversal (CWE-22) that in practice sits at LOW-MEDIUM real-world priority despite the vendor's 8.7 CVSS 4.0 score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade to GitPython 3.1.62 or later (vendor-released patch). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify every application, CI/CD runner, container image, and developer workstation that depends on GitPython (check requirements files, lock files, and SBOMs) and determine whether any workflow checks out submodules at a historical or non-HEAD commit; if so, treat those pipelines as the priority exposure. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Python

View all
CVE-2025-24016 CRITICAL POC
9.9 Feb 10

Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
CVE-2025-27520 CRITICAL POC
9.8 Apr 04

BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
CVE-2025-2945 CRITICAL POC
9.9 Apr 03

pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
CVE-2013-5093 MEDIUM POC
6.8 Sep 27

The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python

CVE-2025-32375 CRITICAL POC
9.8 Apr 09

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
CVE-2014-0224 HIGH POC
7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
CVE-2024-21644 HIGH POC
7.5 Jan 08

pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
CVE-2026-33017 CRITICAL POC
9.3 Mar 17

Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
CVE-2017-9462 HIGH POC
8.8 Jun 06

In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
CVE-2026-49869 CRITICAL POC
10.0 Jun 26

Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to

CVE-2026-39987 CRITICAL POC
9.3 Apr 08

Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
CVE-2024-21645 MEDIUM POC
5.3 Jan 08

pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2022-41352 CRITICAL POC
9.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0

Same technique Path Traversal

View all
CVE-2019-19781 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2022-41352 CRITICAL POC
9.8
CVE-2021-27065 HIGH POC
7.8
CVE-2018-20250 HIGH POC
7.8
CVE-2022-37042 CRITICAL POC
9.8
CVE-2025-64446 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Module for Python 3 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Server 16.0 Affected
SUSE Linux Enterprise Server 16.1 Affected

Share

EUVD-2026-87662 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy