GHSA-7545-fcxq-7j24 GitPython reference APIs has a path traversal vulnerability that allows arbitrary file write and delete outside the repository

• PyPI GitPython: < 3.1.48 → fixed in 3.1.48

🧾 Summary A vulnerability in GitPython allows attackers who can supply a crafted reference path to an application using GitPython to write, overwrite, move, or delete files outside the repository’s `.git` directory via insufficient validation of reference paths in reference creation, rename, and delete operations. --- 📦 Affected Versions • Affected: ` [+] outside_delete exists after delete: False ``` --- 💥 Impact What can an attacker do? • Create or overwrite files outside the repository metadata directory • Delete attacker-chosen files reachable from the process permissions • Corrupt application state or configuration files • Cause denial of service by deleting or overwriting important files --- Security Impact • Confidentiality: Low • Integrity: High • Availability: High --- Who is affected? • Applications that expose GitPython reference operations to user-controlled input • Git automation services, repository management backends, CI/CD helpers, and developer platforms • Multi-user environments where one user can influence ref names processed on behalf of another workflow --- 🛠️ Mitigation / Fix Recommended Fix ```python def _validate_ref_write_path(repo, path, *, for_git_dir=False): SymbolicReference._check_ref_name_valid(path) base = Path(repo.git_dir if for_git_dir else repo.common_dir).resolve() target = (base / path).resolve() if base not in [target, *target.parents]: raise ValueError(f"Reference path escapes repository boundary: {path}") return str(target) ``` ```python full_ref_path = cls.to_full_path(path) _validate_ref_write_path(repo, full_ref_path) ```