Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2023-41040

22
FAUCET Score

CVE-2023-41040 is a path traversal vulnerability affecting the GitPython library (versions prior to 3.1.37), which allows an attacker to force the library to read arbitrary files outside of the intended .git directory. This vulnerability has a CVSS score of 6.5 (Medium), indicating a network-based attack with low complexity, requiring no user interaction or privileges. While it cannot be used to exfiltrate file contents, it could potentially lead to a denial-of-service condition. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.

Impacted Technologies

VendorProductVersion(s)CPE
<= 3.1.34CPE matchmatch criteria
cpe:2.3:a:gitpython_project:gitpython:*:*:*:*:*:python:*:*

CVSS Data

CVSS version used by this source: 3.1

4.0MEDIUM

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
LOW
Exploitability Score
2.5
Impact Score
1.4
CvssVersion
3.1

Exploit Intelligence

EPSS Score
1.02%
Probability of exploitation in next 30 days
EPSS Percentile
59.8%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0102 is in the 38th percentile among its peer group of 23,705 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (20)

pippatch availablevia ghsa
Product: GitPythonFixed in: 3.1.37
redhatpatch availablevia redhat_api
Product: Red Hat Ansible Automation Platform 2.4 for RHEL 8Fixed in: python3x-gitpython-0:3.1.40-1.el8ap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Ansible Automation Platform 2.4 for RHEL 8Fixed in: automation-controller-0:4.5.5-2.el8ap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Ansible Automation Platform 2.4 for RHEL 9Fixed in: python-gitpython-0:3.1.40-1.el9ap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Ansible Automation Platform 2.4 for RHEL 9Fixed in: automation-controller-0:4.5.5-2.el9ap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenStack Platform 17.1 for RHEL 8Fixed in: GitPython-0:3.1.14-2.el8ost
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Satellite 6.14 for RHEL 8Fixed in: python-gitpython-0:3.1.40-0.1.el8pc
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenStack Platform 17.1 for RHEL 9Fixed in: GitPython-0:3.1.14-2.el9ost
View patch
ubuntupatch availablevia ubuntu_usn
Product: python-git (xenial)Fixed in: 1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm4
ubuntupatch availablevia ubuntu_usn
Product: python-git (focal)Fixed in: 3.0.7-1ubuntu0.1~esm4
ubuntupatch availablevia ubuntu_usn
Product: python-git (jammy)Fixed in: 3.1.24-1ubuntu0.1~esm3
ubuntupatch availablevia ubuntu_usn
Product: python-git (noble)Fixed in: 3.1.37-3ubuntu0.1~esm2
ubuntupatch availablevia ubuntu_usn
Product: python-git (resolute)Fixed in: 3.1.46-1ubuntu0.1~esm1
ubuntupatch availablevia ubuntu_usn
Product: python-git (trusty)Fixed in: 0.3.2~RC1-3ubuntu0.1~esm3
ubuntupatch availablevia ubuntu_usn
Product: python-git (bionic)Fixed in: 2.1.8-1ubuntu0.1~esm4
github_advisoryvendor investigatingvia nvd_reference
View patch
redhatend of lifevia redhat_api
Product: Red Hat Certification for Red Hat Enterprise Linux 8Fixed in: redhat-certification
redhatend of lifevia redhat_api
Product: Red Hat Certification Program for Red Hat Enterprise Linux 9Fixed in: redhat-certification
redhatend of lifevia redhat_api
Product: Red Hat OpenStack Platform 16.1Fixed in: GitPython
redhatend of lifevia redhat_api
Product: Red Hat OpenStack Platform 16.2Fixed in: GitPython

Vendor Advisories (3)

ubuntuUSN-8303-1

GitPython vulnerabilities

May 26, 2026
redhatCVE-2023-41040Moderate

GitPython: Blind local file inclusion

Aug 31, 2023
pipGHSA-cwvm-v4w8-q58cmedium

GitPython blind local file inclusion

Aug 30, 2023

References

lists.debian.org / debian-lts-announce/2024/10/msg00030.html
github.com / gitpython-developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/refs/symbolic.py
Product
github.com / gitpython-developers/GitPython/commit/74e55ee4544867e1bd976b7df5a45869ee397b0b
github.com / gitpython-developers/GitPython/commit/e98f57b81f792f0f5e18d33ee658ae395f9aa3c4
github.com / gitpython-developers/GitPython/pull/1672
github.com / gitpython-developers/GitPython/releases/tag/3.1.37
github.com / gitpython-developers/GitPython/security/advisories/GHSA-cwvm-v4w8-q58c
ExploitVendor Advisory
github.com / pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2023-165.yaml
lists.debian.org / debian-lts-announce/2023/09/msg00036.html