Description
GitPython before 3.1.62 does not validate the `path` field read from an untrusted .gitmodules file when updating submodules. While a prior fix (GHSA-hmq2-w58f-27jc) added Submodule._validated_name() to constrain the `name` field, and GitPython's own containment guard Submodule._to_relative_path() is applied in add() and move(), Submodule.update() derives the absolute checkout location from the raw `path` value without that guard. A .gitmodules entry containing directory traversal components (e.g., path = ../../../tmp/escaped) can therefore cause directories to be created via os.makedirs() outside the repository working tree, populated from the submodule URL on the clone path, and removed via shutil.rmtree() when force_remove is used. Exploitation requires an application flow that updates submodules at a non-HEAD commit (such as a historical-commit API); the common clone-then-update flow re-derives the path from a canonical tree lookup and is not affected. The issue is fixed in GitPython 3.1.62.
Published: 2026-09-26
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

GitPython before version 3.1.62 fails to sanitize the `path` field read from an untrusted .gitmodules file during a submodule update. The vulnerability allows directories and files to be created or removed outside the repository working tree via traversal components, enabling arbitrary file writes or deletions that could lead to code execution by an attacker controlling the .gitmodules data. This is a path traversal weakness (CWE‑22).

Affected Systems

The problem affects the GitPython library maintained by the GitPython developers. Any deployment using GitPython versions earlier than 3.1.62 that performs submodule updates without restricting the .gitmodules source is potentially vulnerable.

Risk and Exploitability

The CVSS score of 8.7 indicates high severity. Exploitation requires an application that updates submodules at a non‑HEAD commit, which is a less common but still possible workflow. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, but the high CVSS suggests a significant risk should an attacker achieve the necessary state. Operators should treat this as a serious threat to confidentiality, integrity, and availability of affected systems.

Generated by OpenCVE AI on September 26, 2026 at 16:14 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the GitPython library to version 3.1.62 or later.
  • Audit current projects for submodule update logic that may process untrusted .gitmodules files and restrict such operations to trusted sources only.
  • Scan existing repository clones for malicious .gitmodules entries and validate path values before performing submodule updates.

Generated by OpenCVE AI on September 26, 2026 at 16:14 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 30 Sep 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 27 Sep 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Sat, 26 Sep 2026 18:30:00 +0000

Type Values Removed Values Added
First Time appeared Gitpython-developers
Gitpython-developers gitpython
Vendors & Products Gitpython-developers
Gitpython-developers gitpython

Sat, 26 Sep 2026 13:30:00 +0000

Type Values Removed Values Added
Description GitPython before 3.1.62 does not validate the `path` field read from an untrusted .gitmodules file when updating submodules. While a prior fix (GHSA-hmq2-w58f-27jc) added Submodule._validated_name() to constrain the `name` field, and GitPython's own containment guard Submodule._to_relative_path() is applied in add() and move(), Submodule.update() derives the absolute checkout location from the raw `path` value without that guard. A .gitmodules entry containing directory traversal components (e.g., path = ../../../tmp/escaped) can therefore cause directories to be created via os.makedirs() outside the repository working tree, populated from the submodule URL on the clone path, and removed via shutil.rmtree() when force_remove is used. Exploitation requires an application flow that updates submodules at a non-HEAD commit (such as a historical-commit API); the common clone-then-update flow re-derives the path from a canonical tree lookup and is not affected. The issue is fixed in GitPython 3.1.62.
Title GitPython before 3.1.62 Path Traversal via gitmodules path
First Time appeared Gitpython Project
Gitpython Project gitpython
Weaknesses CWE-22
CPEs cpe:2.3:a:gitpython_project:gitpython:*:*:*:*:*:*:*:*
Vendors & Products Gitpython Project
Gitpython Project gitpython
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Gitpython-developers Gitpython
Gitpython Project Gitpython
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-08T15:21:59.548Z

Reserved: 2026-09-26T02:37:41.037Z

Link: CVE-2026-100689

cve-icon Vulnrichment

Updated: 2026-09-30T17:41:08.463Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-26T14:16:53.420

Modified: 2026-09-30T18:18:01.610

Link: CVE-2026-100689

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-26T13:23:48Z

Links: CVE-2026-100689 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-26T18:15:08Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')