GitPython prior to version 3.1.62 does not properly validate the `path` field read from untrusted .gitmodules files when updating submodules. While earlier fixes constrained the `name` field and applied containment guards in some operations, the Submodule.update() method derives the absolute checkout location directly from the raw `path` value without validation. This allows directory traversal components in the `path` (e.g., ../../../tmp/escaped) to cause directories to be created outside the repository working tree, populated from the submodule URL, and removed when force_remove is used. Exploitation requires an application flow that updates submodules at a non-HEAD commit, such as a historical-commit API. The common clone-then-update flow is not affected. The issue is resolved in GitPython 3.1.62.

An attacker supplying a crafted .gitmodules file with directory traversal in the `path` field can cause GitPython to create and remove directories outside the intended repository directory during submodule update operations at non-HEAD commits. This can lead to unauthorized filesystem modifications, potentially impacting system integrity. The vulnerability has a high severity CVSS score of 8.7.

Upgrade GitPython to version 3.1.62 or later, where this path traversal vulnerability is fixed. No other mitigations are indicated. Users relying on submodule updates at non-HEAD commits should prioritize applying this update.