Duplicate Advisory: Arbitrary local file content disclosure via [include] directive in untrusted .gitmodules (SubmoduleConfigParser never disables merge_includes)

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-7833-fr7j-v32q. This link is maintained to preserve external references. Original Description GitPython before 3.1.59 fails to disable mergeincludes when parsing .gitmodules, allowing attackers to disclose local...

CVE-2026-78675

GitPython before 3.1.59 fails to disable mergeincludes when parsing .gitmodules, allowing attackers to disclose local file content by including arbitrary file paths via include directives. Attackers can craft a malicious .gitmodules file with include directives pointing to sensitive files; when...

PYSEC-2026-3785

GitPython before 3.1.59 fails to disable mergeincludes when parsing .gitmodules, allowing attackers to disclose local file content by including arbitrary file paths via include directives. Attackers can craft a malicious .gitmodules file with include directives pointing to sensitive files; when...

PYSEC-2026-3785

GitPython before 3.1.59 fails to disable mergeincludes when parsing .gitmodules, allowing attackers to disclose local file content by including arbitrary file paths via include directives. Attackers can craft a malicious .gitmodules file with include directives pointing to sensitive files; when...

CVE-2026-78675 GitPython before 3.1.59 Local File Content Disclosure via .gitmodules

GitPython before 3.1.59 fails to disable mergeincludes when parsing .gitmodules, allowing attackers to disclose local file content by including arbitrary file paths via include directives. Attackers can craft a malicious .gitmodules file with include directives pointing to sensitive files; when...

CVE-2026-78675 GitPython before 3.1.59 Local File Content Disclosure via .gitmodules

GitPython before 3.1.59 fails to disable mergeincludes when parsing .gitmodules, allowing attackers to disclose local file content by including arbitrary file paths via include directives. Attackers can craft a malicious .gitmodules file with include directives pointing to sensitive files; when...

CVE-2026-78675

GitPython before 3.1.59 fails to disable merge_includes when parsing .gitmodules, enabling a local file content disclosure attack. An attacker who can place a malicious .gitmodules file in a repository can craft [include] directives pointing to sensitive local files. When repo.submodules is acces...

CVE-2026-78675 GitPython before 3.1.59 Local File Content Disclosure via .gitmodules

GitPython before 3.1.59 fails to disable mergeincludes when parsing .gitmodules, allowing attackers to disclose local file content by including arbitrary file paths via include directives. Attackers can craft a malicious .gitmodules file with include directives pointing to sensitive files; when...

CVE-2026-78675

GitPython before 3.1.59 fails to disable mergeincludes when parsing .gitmodules, allowing attackers to disclose local file content by including arbitrary file paths via include directives. Attackers can craft a malicious .gitmodules file with include directives pointing to sensitive files; when...

CVE-2026-78675

GitPython before 3.1.59 fails to disable mergeincludes when parsing .gitmodules, allowing attackers to disclose local file content by including arbitrary file paths via include directives. Attackers can craft a malicious .gitmodules file with include directives pointing to sensitive files; when...

PT-2026-81902

Compliance-trestle Trestle is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions prior to 3.12.4 and 4.0.0 through 4.0.3, the custom Jinja2 include tags mdsection include and md clean include re-parse the content of an included Markdown file as Jinja2 template...

awxkit: path traversal via YAML !include directive

A path traversal vulnerability was found in awxkit, the CLI tool for AWX. The YAML !include directive does not sanitize file paths, allowing an attacker to craft a malicious YAML file that reads arbitrary YAML-formatted files from the local filesystem when a user imports it using "awx --conf.form...

awxkit: path traversal via YAML !include directive

A path traversal vulnerability was found in awxkit, the CLI tool for AWX. The YAML !include directive does not sanitize file paths, allowing an attacker to craft a malicious YAML file that reads arbitrary YAML-formatted files from the local filesystem when a user imports it using "awx --conf.form...

Important: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.7 Product Security and Bug Fix Update

An update is now available for Red Hat Ansible Automation Platform 2.7 Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

awxkit: path traversal via YAML !include directive

A path traversal vulnerability was found in awxkit, the CLI tool for AWX. The YAML !include directive does not sanitize file paths, allowing an attacker to craft a malicious YAML file that reads arbitrary YAML-formatted files from the local filesystem when a user imports it using "awx --conf.form...

RHEL 10 / 9 : Red Hat Ansible Automation Platform 2.7 Product Security and Bug Fix Update (Important) (RHSA-2026:59137)

The remote Redhat Enterprise Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:59137 advisory. Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT...

Linux Distros Unpatched Vulnerability : CVE-2026-73255

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can control an SSI- enabled file can place directory traversal sequences ...

Winter: Local File Inclusion through =include directives in JavaScript asset compilation

Impact Affected versions of Winter CMS allow authenticated backend users with the cms.manageassets permission "Manage website assets - images, JavaScript files, CSS files" to disclose arbitrary files readable by the PHP process by placing an =include / =require directive in a theme JavaScript...

CVE-2026-73255

Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can control an SSI-enabled file can place directory traversal sequences in an include file or include virtual directive. The mgssi function in src/ssi.c concatenates the directive argument into a filesystem pat...

CVE-2026-73255

Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can control an SSI-enabled file can place directory traversal sequences in an include file or include virtual directive. The mgssi function in src/ssi.c concatenates the directive argument into a filesystem pat...