PT-2026-71447

CVE-2026-73619

Published

2026-07-26

Updated

2026-10-23

Description by

CVSS 4.0

9.3

Critical

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.57

Description An incomplete denylist in the unsafe git archive options guard allows attackers to provide the --add-file and --add-virtual-file options to the Repo.archive() function. This can be exploited to read arbitrary files from the filesystem and include them in the generated archive.

Recommendations Update GitPython to version 3.1.57 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Anir0Y

Vendors

Affected products

Weakness enumeration

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

CWE-73: External Control of File Name or Path