CVE-2026-76217
CVE-2026-76217: 1 tracked advisory record across Red Hat. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Red Hat
1 advisory- Advisory severityMedium6.5
Medium [CVE-2026-76217] Arbitrary File Read via Crafted Parameters
CVE-2026-76217Source published Source updated
GitPython versions before 3.1.58 fail to validate options passed to git rm and git checkout commands in IndexFile.remove() and Head.checkout(). Attackers can supply --pathspec-from-file and --pathspec-file-nul parameters to read arbitrary files accessible to the process, with full file contents returned in GitCommandError.stderr. A remote attacker with low privileges could exploit this by supplying crafted parameters, such as --pathspec-from-file and --pathspec-file-nul. This vulnerability allows for arbitrary file disclosure, enabling the attacker to read any file accessible to the GitPython process. Exploitation requires an application to pass untrusted, attacker-controlled input directly as the path/pathspec argument to these GitPython methods; in normal use these arguments are…
- Affected products in this advisory
- Red Hat Ansible Automation Platform 2
- Red Hat OpenStack Platform 16.2
- Red Hat OpenStack Platform 17.1
- Red Hat Satellite 6
- Source-reported affected versions
- < 3.1.58
- Source-reported fixed versions
- No fixed-version detail extracted. This does not mean no fix exists.
- Mitigation guidance
- Applications using GitPython should not pass untrusted or attacker-controlled input directly as the path/pathspec argument to IndexFile.remove() or Head.checkout(), and should reject any such value beginning with a dash ("-") so that it cannot be interpreted as a git option. Updating GitPython to version 3.1.58 or later, which validates these options, resolves the issue.
Android app · Google Play
Monitor future Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.