Threats tagged 'ghsa-7545-fcxq-7j24'

GitPython versions up to 3.1.46 and the current main branch (3.1.47 locally) have a path traversal vulnerability in their reference APIs. This flaw allows attackers who can supply crafted reference paths to write, overwrite, move, or delete files outside the repository's .git directory due to insufficient validation of reference paths during write, rename, and delete operations. The vulnerability does not require authentication at the library boundary but requires the ability to influence ref names passed to GitPython. A fix is available in version 3.1.48.