CVE-2026-78678 GitPython before 3.1.59 Arbitrary File Read via Repo.blame()
Attackers can read arbitrary files by exploiting an incomplete denylist in GitPython's Repo.blame() method, leading to information disclosure.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-78678?
CVE-2026-78678 is a high-severity path traversal vulnerability in gitpython-developers GitPython, published on 25 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
GitPython versions before 3.1.59 contain an incomplete denylist in the unsafe_git_revision_options guard that omits --contents and -S options, allowing attackers to read arbitrary files by passing these options to Repo.blame(). Attackers can supply revision values like --contents=/etc/passwd to leak file contents through the blame result returned to the caller.
Weakness: CWE-88
Which versions are affected by CVE-2026-78678?
3 open source packages ship an affected version, including gitpython and GitPython. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
gitpython PyPI | All versions | 3.1.59 |
gitpython PyPI | All versions | 3.1.59 |
GitPython PyPI | All versions | 3.1.59 |
Products include Gitpython Project Gitpython.
How do I fix CVE-2026-78678?
Upgrade gitpython to 3.1.59 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-78678 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-78678 exists.
Other vulnerabilities in gitpython-developers GitPython
- CVE-2023-40267 GitPython vulnerable to remote code execution due to insufficient sanitization of input arguments
- CVE-2026-78676 GitPython before 3.1.59 Remote Code Execution via Config Injection
- CVE-2026-67324 GitPython 3.1.50 Authentication Bypass via Joined Short Options
- CVE-2026-42215 GitPython: Command injection via Git options bypass
- CVE-2026-87817 GitPython before 3.1.60 Remote Code Execution via Git Directory Impersonation
Sources
Also known as DEBIAN-CVE-2026-78678, ECHO-e36b-bab9-b00b, GHSA-5xxx-qhh7-9287, MINI-c8j7-qv5m-qfj7, MINI-ch3x-wr6p-5xx5, MINI-g6gp-6cmj-c375 and 2 more.