Description
GitPython before 3.1.57 contains an incomplete denylist in the unsafe_git_archive_options guard that omits --add-file and --add-virtual-file options. Attackers can supply these options to Repo.archive() to read arbitrary files from the filesystem and include them in the returned archive.
Published: 2026-08-13
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

GitPython before 3.1.57 contains an incomplete denylist that allows the unsafe_git_archive_options guard to accept the --add-file and --add-virtual-file options. A malicious user who can influence the arguments passed to Repo.archive() can cause the function to read any file on the filesystem and include it in the generated archive, thereby compromising confidentiality. The weakness is a directory traversal (CWE-22) and an arbitrary file read flaw (CWE-73).

Affected Systems

The vulnerability affects the GitPython library developed by gitpython‑developers. Any code that imports gitpython and calls git.Repo.archive() before the 3.1.57 release is vulnerable. Specifically, systems running GitPython versions below 3.1.57, such as 3.1.56 or earlier, are impacted.

Risk and Exploitability

The CVSS score of 7.1 indicates a high severity, while the EPSS score of < 1% suggests a low current exploitation probability and the vulnerability is not listed in CISA KEV. An attacker who can influence the parameters passed to Repo.archive() could read arbitrary files from the host filesystem and include them in the generated archive. The vulnerability requires code that invokes Repo.archive() with the disallowed --add-file or --add-virtual-file options.

Generated by OpenCVE AI on August 15, 2026 at 01:53 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the GitPython library to version 3.1.57 or later, where the denylist has been corrected.
  • Review any custom usage of Repo.archive() and verify that no disallowed options are passed; remove or sanitize any input that may supply '--add-file' or '--add-virtual-file'.
  • If an upgrade is not immediately possible, disable the use of Repo.archive() in insecure contexts or replace it with a safer archival method that does not expose file read capabilities.

Generated by OpenCVE AI on August 15, 2026 at 01:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 15 Aug 2026 04:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 15 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-22
References
Metrics threat_severity

None

 threat_severity

Moderate

Fri, 14 Aug 2026 17:15:00 +0000

Type Values Removed Values Added
First Time appeared Gitpython Project
Gitpython Project gitpython
CPEs cpe:2.3:a:gitpython_project:gitpython:*:*:*:*:*:python:*:*
Vendors & Products Gitpython Project
Gitpython Project gitpython

Thu, 13 Aug 2026 13:30:00 +0000

Type Values Removed Values Added
First Time appeared Gitpython-developers
Gitpython-developers gitpython
Vendors & Products Gitpython-developers
Gitpython-developers gitpython

Thu, 13 Aug 2026 11:45:00 +0000

Type Values Removed Values Added
Description GitPython before 3.1.57 contains an incomplete denylist in the unsafe_git_archive_options guard that omits --add-file and --add-virtual-file options. Attackers can supply these options to Repo.archive() to read arbitrary files from the filesystem and include them in the returned archive.
Title GitPython before 3.1.57 Arbitrary File Read via Repo.archive()
Weaknesses CWE-73
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Gitpython-developers Gitpython
Gitpython Project Gitpython
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-08-15T03:11:36.267Z

Reserved: 2026-08-13T11:16:27.835Z

Link: CVE-2026-73619

cve-icon Vulnrichment

Updated: 2026-08-15T03:11:30.950Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-08-13T12:17:26.913

Modified: 2026-08-31T20:25:28.573

Link: CVE-2026-73619

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-08-13T11:28:20Z

Links: CVE-2026-73619 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-15T02:00:04Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

  • CWE-73

    External Control of File Name or Path