8.6

CVE-2026-78675: gitpython_project gitpython External Control of File Name or Path

CVSS: 8.6v4.0HighAnalyzed
AliasesGHSA-7833-fr7j-v32qPYSEC-2026-3785DEBIAN-CVE-2026-78675
Published 25-08-2026Last modified 08-10-2026
Open JSON

Vulnerability summary

CVE-2026-78675 is a high (CVSS 8.6) External Control of File Name or Path vulnerability in gitpython_project gitpython. EPSS estimates a 0.18% chance of exploitation in the next 30 days, higher than 6.9% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
44/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.6/10
010
High · v4.0 (CVE.org)
EPSS score
0.18%
0%100%
Low · +0.06 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github

Advisory lineage

Upstream 0 · Downstream 2 · Related 2
OPENSUSE-SU-2026:21874-1SUSE-SU-2026:4072-1

Timeline

  1. 25-08-2026
    PublishedVulnerability first disclosed.
  2. 08-10-2026
    Last modifiedVulnerability information updated.

Description

GitPython before 3.1.59 fails to disable merge_includes when parsing .gitmodules, allowing attackers to disclose local file content by including arbitrary file paths via [include] directives. Attackers can craft a malicious .gitmodules file with include directives pointing to sensitive files; when repo.submodules is accessed, GitConfigParser raises MissingSectionHeaderError embedding the target file's first line verbatim in the exception message.

CVSS metrics

6 scores · 4 sources · 2 versions

EPSS trend

Probability

0.18%

Chance of exploitation in the next 30 days

Percentile

7%

Versus all other CVEs

30-day change

+0.06 pp

From 0.12% on 20-09-2026

20-09-202620-10-2026
EPSS score
0.18%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • githubUnverified

    Gitpython

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Chainguard1 product
  • mlflow< 3.16.0-r0
Debian1 product
  • python-gitAll versions (No fix recorded) | < 3.1.61-1
Gitpython_project1 product
Gitpython-developers1 product
PyPI1 product
  • gitpython< 3.1.59
Wolfi1 product
  • mlflow< 3.16.0-r0

6 vendors · 6 products

References

9 links