Bug 2531304

Summary: CVE-2026-78675 GitPython: GitPython: Local file content disclosure via malicious .gitmodules [epel-all]
Product: [Fedora] Fedora EPEL Reporter: nlevinki <nlevinki>
Component: GitPythonAssignee: Lubomír Sedlář <lsedlar>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: medium    
Version: epel10CC: athoscribeiro, carlwgeorge, code, igor.raits, lsedlar
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["8671a7d3-643b-4614-a054-a3deaf4d933c"]}
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2026-09-10 07:56:33 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2523214    

Description nlevinki 2026-09-10 07:29:23 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

GitPython before 3.1.59 fails to disable merge_includes when parsing .gitmodules, allowing attackers to disclose local file content by including arbitrary file paths via [include] directives. Attackers can craft a malicious .gitmodules file with include directives pointing to sensitive files; when repo.submodules is accessed, GitConfigParser raises MissingSectionHeaderError embedding the target file's first line verbatim in the exception message.
Comment 1 Ben Beasley 2026-09-10 07:56:33 UTC 
This is fixed in 3.1.59, and GitPython is at a later version in all Fedora and EPEL branches, except for EPEL8, which cannot be updated. It’s a real waste of time having to close bugs like this. Comparing the version number in the advisory with the version number in the repos is the lowest-hanging of all possible fruit, so it’s frustrating that it still hasn’t been attempted.