CVE-2026-73619: GitPython before 3.1.57 Arbitrary File Read via Repo.archive()
Published Aug 13, 2026
·Updated
GitPython before 3.1.57 contains an incomplete denylist in the unsafegitarchiveoptions guard that omits --add-file and --add-virtual-file options. Attackers can supply these options to Repo.archive() to read arbitrary files from the filesystem and include them in the returned archive.
Affected Software
1 affected component
GitPython GitPython<3.1.57
Event History
Aug 13, 2026
CVE Published
via MITRE·11:28 AM
Data Sourced
via MITRE·11:28 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-73619?
The severity of CVE-2026-73619 is medium, with a score of 6.5.
2
How do I fix CVE-2026-73619?
To fix CVE-2026-73619, upgrade GitPython to version 3.1.57 or later.
3
What can an attacker do with CVE-2026-73619?
An attacker can exploit CVE-2026-73619 to read arbitrary files from the filesystem by using the Repo.archive() method.
4
Which versions of GitPython are affected by CVE-2026-73619?
CVE-2026-73619 affects all versions of GitPython prior to 3.1.57.
5
What are the implications of CVE-2026-73619?
The implications of CVE-2026-73619 include unauthorized access to sensitive files through the misuse of archive options.