GitPython, a Python library for interacting with Git repositories, has a path traversal vulnerability (CWE-22) in versions before 3.1.48. The vulnerability arises from improper validation of reference paths used in reference creation, rename, and delete operations, enabling an attacker who can supply crafted reference paths to manipulate files outside the repository's .git directory. This can lead to unauthorized file write, overwrite, move, or deletion. The vulnerability is rated high severity with a CVSS 4.0 score of 7.8 and has been patched in GitPython version 3.1.48.

Exploitation of this vulnerability allows an unauthenticated attacker to perform unauthorized file system operations outside the intended .git directory, potentially leading to data corruption, loss, or unauthorized modification of files on the host system. This can compromise the integrity of the system or application using GitPython. No public exploits are currently known.

Upgrade GitPython to version 3.1.48 or later, where this path traversal vulnerability has been patched. There is no indication of alternative mitigations or temporary fixes. Users should verify they are not using affected versions to prevent exploitation.