PT-2026-78404

CVE-2026-76222

Published

2026-08-04

Updated

2026-09-22

Description by

CVSS 2.0

8.5

High

MetricsAV:N/AC:L/Au:N/C:N/I:C/A:P

Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.58

Description GitPython fails to validate submodule names within .gitmodules files. This allows an attacker to use traversal sequences in submodule names during submodule initialization to create Git repositories at arbitrary filesystem paths outside the intended clone directory.

Recommendations Update GitPython to version 3.1.58 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Tinyb0Y

Vendors

Affected products

Weakness enumeration

CWE-73: External Control of File Name or Path

CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\'Path Traversal\')