CVE-2026-100689 GitPython before 3.1.62 Path Traversal via gitmodules path
Attackers can create or delete directories outside the repository via malicious .gitmodules paths during specific submodule update flows.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-100689?
CVE-2026-100689 is a high-severity path traversal vulnerability in gitpython-developers GitPython, published on 26 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
GitPython before 3.1.62 does not validate the `path` field read from an untrusted .gitmodules file when updating submodules. While a prior fix (GHSA-hmq2-w58f-27jc) added Submodule._validated_name() to constrain the `name` field, and GitPython's own containment guard Submodule._to_relative_path() is applied in add() and move(), Submodule.update() derives the absolute checkout location from the raw `path` value without that guard. A .gitmodules entry containing directory traversal components (e.g., path = ../../../tmp/escaped) can therefore cause directories to be created via os.makedirs() outside the repository working tree, populated from the submodule URL on the clone path, and removed via shutil.rmtree() when force_remove is used. Exploitation requires an application flow that updates submodules at a non-HEAD commit (such as a historical-commit API); the common clone-then-update flow re-derives the path from a canonical tree lookup and is not affected. The issue is fixed in GitPython 3.1.62.
Weakness: CWE-22
Which versions are affected by CVE-2026-100689?
2 open source packages ship an affected version, including GitPython and gitpython.
| Package | Affected | Fixed in |
|---|---|---|
GitPython PyPI | All versions | 3.1.62 |
gitpython PyPI | All versions | 3.1.62 |
Linux distribution packages (1)
python-GitPython openSUSE:Tumbleweed | All versions | 3.2.0-1.1 |
How do I fix CVE-2026-100689?
Upgrade GitPython to 3.1.62 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-100689 being exploited?
There is no known exploitation of CVE-2026-100689 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-100689, ECHO-a8ec-12fb-5bb8, ECHO-b949-dc62-0fed, GHSA-59cr-6r3x-644w, GHSA-cw5h-x3x9-4mwp, MINI-836f-pv4v-6p3c and 6 more.