CVE-2026-76222: GitPython before 3.1.58 Path Traversal via .gitmodules Submodule Name
GitPython before 3.1.58 fails to validate submodule names from .gitmodules files, allowing attackers to create Git repositories at arbitrary filesystem paths outside the intended clone directory. Attackers can craft malicious repositories with traversal sequences in submodule names that GitPython processes during submodule initialization, creating attacker-controlled Git repositories at escaped filesystem locations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/python-gitto a version that resolves this vulnerability.Fixed in 3.1.30-1+deb12u3 - Upgrade
Upgrade
debian/python-gitto a version that resolves this vulnerability.Fixed in 3.1.44-1+deb13u1 - Upgrade
Upgrade
debian/python-gitto a version that resolves this vulnerability.Fixed in 3.1.61-1 - Upgrade
Upgrade
debian/python-gitto a version that resolves this vulnerability.Fixed in 3.1.30-1+deb12u3Fixed in 3.1.44-1+deb13u1Fixed in 3.2.1-1 - Upgrade
Upgrade
alpine/py3-gitpythonto a version that resolves this vulnerability.Fixed in 3.1.61-r0
Event History
Frequently Asked Questions
What conditions are required for exploitation?
An attacker must persuade a user or system to process a malicious repository containing a crafted .gitmodules file during GitPython submodule initialization. No attacker privileges are required, but user interaction is required.
Which deployments are exposed?
GitPython versions before 3.1.58 are affected when they initialize submodules from repositories whose .gitmodules content may be attacker-controlled or untrusted.
What is the impact of a successful exploit?
A malicious submodule name containing traversal sequences can cause GitPython to create attacker-controlled Git repositories at filesystem locations outside the intended clone directory. The vulnerability has high severity, with integrity impact rated high and availability impact rated low.
What should be done if an immediate upgrade is not possible?
Avoid initializing submodules from untrusted repositories or repositories with untrusted .gitmodules files. Treat repositories that use traversal sequences in submodule names as unsafe until GitPython can be updated to 3.1.58 or later.