Gitpython-Developers · weakness class
File and Path Handling
13 CVEs
Every dot is a CVE in what this vendor ships; the named ones are the most at risk.
Every one of the 13 is a mark on the map. Named now: 1 to 13, most at risk first.
- GitPython blind local file inclusion
- GitPython before 3.1.59 Path Traversal via separate-git-dir
- GitPython before 3.1.57 Arbitrary File Overwrite and Read
- Untrusted search path on Windows systems leading to arbitrary code execution
- GitPython before 3.1.58 Path Traversal via .gitmodules Submodule Name
- GitPython: Path traversal in GitPython reference APIs allows arbitrary file write and delete outside the repository
- GitPython before 3.1.58 Arbitrary File Read via pathspec-from-file
- GitPython before 3.1.57 Arbitrary File Read via Repo.archive()
- GitPython before 3.1.62 Path Traversal via gitmodules path
- GitPython before 3.1.59 Arbitrary File Read via TagReference.create
- Untrusted search path under some conditions on Windows allows arbitrary code execution
- GitPython 3.1.62 before 3.2.0 Symlink Path Traversal via Submodule.move()
- GitPython before 3.1.59 Local File Content Disclosure via .gitmodules
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.