A path traversal vulnerability in GitPython allows attackers to access files outside of the target directory, posing a risk of unauthorized information disclosure.

The library fails to properly restrict pathnames to a restricted directory, enabling a path traversal attack. The vulnerability is exploitable over the network by an unauthenticated attacker, as indicated by the CVSS vector.

Successful exploitation allows an attacker to read files on the server that the application process has permission to access. With a CVSS score of 7.5, this vulnerability represents a significant risk to data confidentiality and could allow an attacker to harvest configuration details or source code from the host.

Immediate Action: Upgrade to GitPython version 3.1.59 or later to implement the necessary path validation and traversal protections.

Proactive Monitoring: Review application logs for directory traversal patterns, such as the inclusion of relative path sequences, within requests processed by GitPython.

Compensating Controls: Implement input validation on all paths provided to GitPython functions and use a Web Application Firewall to block requests containing directory traversal sequences.

Public Exploit Available: No

To mitigate the risk of unauthorized file access, it is essential to update GitPython to version 3.1.59 immediately. Security teams should ensure that all downstream applications consuming this library are also updated and tested.