Copyright © 2012 Red Hat, Inc. All rights reserved. Low 2026-08-20T18:35:10 libgit2: libgit2: Submodule path traversal allows arbitrary directory creation 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N CWE-22

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 does not reject traversal components in a submodule path loaded from .gitmodules. The affected src/libgit2/submodule.c paths include git_submodule_lookup and git_submodule_add_setup. A crafted repository can specify a path such as ../escape-target, and applications that initialize the submodule can create directories outside the repository working tree. This issue is fixed in versions 1.8.6 and 1.9.5.

A flaw was found in libgit2. This vulnerability allows a remote attacker to create directories outside of the intended repository working tree. By crafting a malicious repository that specifies traversal components in a submodule path, applications initializing the submodule can be tricked into creating directories in arbitrary locations on the file system. This could lead to unintended file system modifications or potentially further compromise.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Red Hat Hardened Images 2026-08-25T00:00:00Z RHSA-2026:59361 libgit2-main-1.9.7-1.hum1 Red Hat Enterprise Linux 10 Fix deferred rust Red Hat Enterprise Linux 8 Fix deferred libgit2 Red Hat Enterprise Linux 9 Fix deferred rust Red Hat Enterprise Linux AI (RHEL AI) 3 Fix deferred libgit2 Red Hat Enterprise Linux AI (RHEL AI) 3 Fix deferred rust https://www.cve.org/CVERecord?id=CVE-2026-53584 https://nvd.nist.gov/vuln/detail/CVE-2026-53584 https://github.com/libgit2/libgit2/commit/419637d3587396f5d139d6d88480eab3cd81e7a1 https://github.com/libgit2/libgit2/commit/467c2d95ed663df722f83a5960edf568514b128c https://github.com/libgit2/libgit2/commit/ec7371da9f359cd8293e9108e7a0b1c1b61b67c4 https://github.com/libgit2/libgit2/releases/tag/v1.8.6 https://github.com/libgit2/libgit2/releases/tag/v1.9.5 https://github.com/libgit2/libgit2/security/advisories/GHSA-cw77-j82w-mchm