GitPython: Arbitrary local file content disclosure

Published September 8, 2026 CVE-2026-78675

GitPython: Arbitrary local file content disclosure via [include] directive in untrusted .gitmodules (SubmoduleConfigParser never disables mergeincludes). [HIGH] Arbitrary local file content disclosure via [include] directive in untrusted .gitmodules (SubmoduleConfigParser never disables mergeincludes) CWE: CWE-200 (Exposure of Sensitive Information) / CWE-73 (External Control of File Name or Path) Affected component: git/objects/submodule/base.py, Submodule.configparser() (line 273) constructing SubmoduleConfigParser(fpmodule, readonly=readonly). Git/config.py, GitConfigParser.init (mergeincludes default), GitConfigParser.read()/includedpaths() (include-path resolution, lines 630-685), GitConfigParser.read() (line 493-498, MissingSectionHeaderError) Affected version: GitPython at HEAD (9729ed3b948f2bde09f1f188c5311e172212b67e, 2026-08-05, VERSION 3.1.58) Reachability GitConfigParser.init defaults mergeincludes=True: any config file it parses has its [include] (and, when a repo= is supplied, [includeIf...]) directives followed and merged in.

Severity
HighCVSS 3.1 · 8.4
Fix
Fixed in 3.1.59
Affected versions
before 3.1.59
Weakness
CWE-73
Exploit likelihood
0.12% in 30 daysEPSS, higher than 2% of known flaws
Affects
GitPython

What to do

Update to 3.1.59 or later.

Severity breakdown

  • Attack vector Local Needs local access to the machine
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required None Attacker needs no account or login
  • User interaction None No victim action needed
  • Scope Unchanged Impact stays within the same security authority
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact High Protected data can be changed with serious impact
  • Availability impact High The service can stop or suffer serious disruption
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Open in FIRST.org calculator

References

View Original Source