GitPython blind local file inclusion
Priority MEDIUM 62CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · None · Low
- Fix status
- Partial Red Hat: 4 fixed, 5 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
GitPython is a python library used to interact with Git repositories. In order to resolve some git references, GitPython reads files from the `.git` directory, in some places the name of the file being read is provided by the user, GitPython doesn't check if this file is located outside the `.git` directory. This allows an attacker to make GitPython read any file from the system. This vulnerability is present in https://github.com/gitpython-developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/refs/symbolic.py#L174-L175. That code joins the base directory with a user given string without checking if the final path is located outside the base directory. This vulnerability cannot be used to read the contents of files but could in theory be used to trigger a denial of service for the program. This issue has been addressed in version 3.1.37.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01093 65th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial GitPython (gitpython-developers): 3.1.37GitPython (PyPI): 3.1.37Red Hat: 5 advisoriesRed Hat: 4 fixed, 5 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| gitpython-developers | GitPython | before 3.1.37 | 3.1.37 | Patch available | CNA |
| — | GitPython (PyPI) | before 3.1.37 | 3.1.37 | Patch available | GHSA-cwvm-v4w8-q58c |
- GitPython Vendorgitpython-developers Affected before 3.1.37 Fixed in 3.1.37 Patch available CNA
- GitPython (PyPI) Vendor— Affected before 3.1.37 Fixed in 3.1.37 Patch available GHSA-cwvm-v4w8-q58c
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:gitpython_project:gitpython:*:*:*:*:*:python:*:* | up to 3.1.34 | Vulnerable | gitpython-developers |
- cpe:2.3:a:gitpython_project:gitpython:*:*:*:*:*:python:*:* Versions up to 3.1.34 Vulnerable ·gitpython-developers
Remediation
- Fix · CNA GitPython (gitpython-developers) Fixed in 3.1.37
- Fix · GHSA-cwvm-v4w8-q58c GitPython (PyPI) Fixed in 3.1.37 Advisory →
Red Hat 5 advisories
- RHSA-2024:1640 Released 2024-04-02 · Red Hat rating ModerateRed Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update
- Red Hat Ansible Automation Platform 2.4 for RHEL 8 automation-controller-venv-tower-4.5.5-2.el8ap, python39-aiohttp-3.9.3-1.el8ap, python39-django-4.2.11-1.el8ap +4
- Red Hat Ansible Automation Platform 2.4 for RHEL 9 automation-controller-venv-tower-4.5.5-2.el9ap, python-aiohttp-3.9.3-1.el9ap, python-django-4.2.11-1.el9ap +4
- RHSA-2024:0322 Released 2024-01-22 · Red Hat rating ModerateRed Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update
- Red Hat Ansible Automation Platform 2.4 for RHEL 8 python39-gitpython-3.1.40-1.el8ap, python39-twisted+tls-23.10.0-1.el8ap, python39-twisted-23.10.0-1.el8ap +2
- Red Hat Ansible Automation Platform 2.4 for RHEL 9 python-gitpython-3.1.40-1.el9ap, python-twisted-23.10.0-1.el9ap, python3-gitpython-3.1.40-1.el9ap +2
- RHSA-2024:0190 Released 2024-01-16 · Red Hat rating ModerateRed Hat OpenStack Platform 17.1 (GitPython) security update
- Red Hat OpenStack Platform 17.1 GitPython-3.1.14-2.el8ost, python3-GitPython-3.1.14-2.el8ost
Show 2 more Red Hat advisories
- RHSA-2024:0215 Released 2024-01-16 · Red Hat rating ModerateRed Hat OpenStack Platform 17.1 (GitPython) security update
- Red Hat OpenStack Platform 17.1 GitPython-3.1.14-2.el9ost, python3-GitPython-3.1.14-2.el9ost
- RHSA-2023:7851 Released 2023-12-14 · Red Hat rating ModerateSatellite 6.14.1 Async Security Update
- Red Hat Satellite 6.14 for RHEL 8 createrepo_c-1.0.2-2.el8pc, createrepo_c-libs-1.0.2-2.el8pc, foreman-3.7.0.10-1.el8sat +47
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Certification Program for Red Hat Enterprise Linux 9 | Affected | No fix planned: Will not fix |
| Red Hat Certification for Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Certification for Red Hat Enterprise Linux 8 | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 16.1 | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 16.2 | Affected | No fix planned: Will not fix |
| Red Hat Ansible Automation Platform 2.4 for RHEL 8 | Fixed | RHSA-2024:0322, RHSA-2024:1640 |
| Red Hat Ansible Automation Platform 2.4 for RHEL 9 | Fixed | RHSA-2024:0322, RHSA-2024:1640 |
| Red Hat OpenStack Platform 17.1 | Fixed | RHSA-2024:0190, RHSA-2024:0215 |
| Red Hat Satellite 6.14 for RHEL 8 | Fixed | RHSA-2023:7851 |
Not affected: 3 products
- Red Hat Ansible Automation Platform 2.4 for RHEL 8
- Red Hat Ansible Automation Platform 2.4 for RHEL 9
- Red Hat Satellite 6.14 for RHEL 8
Timeline
- 2026-10-02 Threatist record created from CVE-2023-41040
- 2026-10-03 Alias added: GHSA-cwvm-v4w8-q58c
References
Other 9
- https://github.com/gitpython-developers/GitPython/pull/1672
- https://github.com/gitpython-developers/GitPython/commit/74e55ee4544867e1bd976b7df5a45869ee397b0b
- https://github.com/gitpython-developers/GitPython/commit/e98f57b81f792f0f5e18d33ee658ae395f9aa3c4
- https://github.com/gitpython-developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/refs/symbolic.py#L174-L175
- https://github.com/gitpython-developers/GitPython/releases/tag/3.1.37
- https://github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2023-165.yaml
- https://lists.debian.org/debian-lts-announce/2023/09/msg00036.html
- https://github.com/gitpython-developers/GitPython
- https://lists.debian.org/debian-lts-announce/2024/10/msg00030.html
More gitpython-developers Gitpython vulnerabilities
- TI-2026-54689 GitPython before 3.1.59 Path Traversal via separate-git-dir CVSS 4.0HIGH 8.7
- TI-2026-51706 GitPython before 3.1.55 Environment Variable Exfiltration via Remote.add() CVSS 4.0HIGH 8.7
- TI-2026-47618 GitPython before 3.1.52 Environment Variable Exfiltration via clone_from CVSS 4.0HIGH 8.7
- TI-2026-30595 GitPython: Unsafe option check validates multi_options before shlex.split transforms it CVSS 3.1CRITICAL 9.8
- TI-2026-32220 GitPython: Path traversal in GitPython reference APIs allows arbitrary file write and delete outside the repository CVSS 4.0HIGH 7.8
- TI-2026-47621 GitPython before 3.1.51 Command Injection via option prefix abbreviation CVSS 4.0HIGH 8.7
Sources
- CVE-2023-41040 · CVE Program
- CVE-2023-41040 · NVD
- FIRST EPSS
- GHSA-cwvm-v4w8-q58c · GitHub Advisory Database · CC BY 4.0
- CVE-2023-41040 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences