Threats tagged 'brew-fdroidserver-cve-2026-44243'

A path traversal vulnerability in GitPython allows attackers who can supply crafted reference paths to write, overwrite, move, or delete files outside the repository's .git directory. This occurs due to insufficient validation of reference paths before filesystem write, rename, and delete operations. The vulnerability affects GitPython versions up to 3.1.46 and the current main branch (3.1.47 locally). Exploitation requires the ability to influence reference names passed to GitPython APIs, with no authentication required at the library boundary. The flaw can lead to arbitrary file write and deletion, potentially corrupting application state or causing denial of service.