---
schema_version: '1.0'
id: security-20260714-452cd1
url: https://osv.dev/vulnerability/PYSEC-2026-2162
url_hash: 452cd118c7dc331693404e097a2839184ee6d2d9360272c4bbab970e74e9e1a5
canonical_url: https://osv.dev/vulnerability/PYSEC-2026-2162
source: osv:pypa
category: security/library
category_raw: cve/library
region: null
tags:
- cve
- CVE-2026-44243
- PYSEC-2026-2162
- severity:CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
- gitpython
- PyPI
lang: en
published_at: '2026-05-07T19:16:02Z'
fetched_at: '2026-07-14T06:42:23Z'
updated_at: '2026-07-14T06:43:41Z'
status: published
content_hash: 481988d47efe160c211fbd5c7a3d12425509caa9eb67a37a4925c6415be3a1b0
license_note: full
summary: GitPython is a python library used to interact with Git repositories. Prior
  to version 3.1.48, a vulnerability in GitPython allows attackers who can supply
  a crafted reference path to an application using GitPython to write, overwrite,
  move, or delete files outside the repository
summary_source: rss
summary_en: GitPython is a python library used to interact with Git repositories.
  Prior to version 3.1.48, a vulnerability in GitPython allows attackers who can supply
  a crafted reference path to an application using GitPython to write, overwrite,
  move, or delete files outside the repository
entities: []
key_facts: []
related: []
related_auto: []
title: CVE-2026-44243 — gitpython
---

# CVE-2026-44243 — gitpython

## TL;DR
GitPython is a python library used to interact with Git repositories. Prior to version 3.1.48, a vulnerability in GitPython allows attackers who can supply a crafted reference path to an application using GitPython to write, overwrite, move, or delete files outside the repository

## Key Points
- cve / CVE-2026-44243 / PYSEC-2026-2162 / severity:CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H / gitpython / PyPI

## Details
**Severity:** CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
**Advisory:** PYSEC-2026-2162 (CVE-2026-44243)

**Affected (your watchlist):**
- `PyPI:gitpython` 3.1.46 → fixed in 3.1.48 [docker/docker-llmwiki]

**Details:**
GitPython is a python library used to interact with Git repositories. Prior to version 3.1.48, a vulnerability in GitPython allows attackers who can supply a crafted reference path to an application using GitPython to write, overwrite, move, or delete files outside the repository’s .git directory via insufficient validation of reference paths in reference creation, rename, and delete operations. This issue has been patched in version 3.1.48.

**References:**
- https://github.com/gitpython-developers/GitPython/releases/tag/3.1.48
- https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-7545-fcxq-7j24

_Data: OSV.dev (upstream: pypa) — https://osv.dev/vulnerability/PYSEC-2026-2162_

## Source
元記事: [CVE-2026-44243 — gitpython](https://osv.dev/vulnerability/PYSEC-2026-2162) — published 2026-05-07T19:16:02Z