CVE-2026-76217

Katalog CVE

CVSS 6.5 · Medium EPSS 0,41%

Kerentanan External Control of File Name or Path pada gitpython project gitpython. Skor CVSS 3.1 6.5 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

GitPython versions before 3.1.58 fail to validate options passed to git rm and git checkout commands in IndexFile.remove() and Head.checkout(). Attackers can supply --pathspec-from-file and --pathspec-file-nul parameters to read arbitrary files accessible to the process, with full file contents returned in GitCommandError.stderr.

Rincian

Terbit di NVD

19 Agustus 2026

Terakhir diubah

3 September 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-73: External Control of File Name or Path

EPSS (30 hari)

0,41% peluang dieksploitasi; lebih tinggi dari 33,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-hh9p-6wh2-4mfc exploit · advisory vendor
• https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-read-via-pathspec-from-file advisory pihak ketiga