libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 does not reject traversal components in a submodule path loaded from .gitmodules. The affected src/libgit2/submodule.c paths include git_submodule_lookup and git_submodule_add_setup. A crafted repository can specify a path such as ../escape-target, and applications that initialize the submodule can create directories outside the repository working tree. This issue is fixed in versions 1.8.6 and 1.9.5.
CVSS Details
- CVSS 3.1 Base Score: 4.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade libgit2 | Aug 21, 2026 | Aug 20, 2026 |
| Amazon_linux_2023 | — | Upgrade cargo-debuginfoUpgrade mount-s3-debuginfoUpgrade rust-std-static-wasm32-unknown-unknownUpgrade mount-s3Upgrade libgit2Upgrade rust-std-static-wasm32-wasip1Upgrade rust-debugsourceUpgrade rust-gdbUpgrade rustfmtUpgrade mount-s3-debugsourceUpgrade rust-lldbUpgrade cargoUpgrade rust-cargo-c-debugsourceUpgrade rustfmt-debuginfoUpgrade rust-analyzer-debuginfoUpgrade rust-analyzerUpgrade rust-toolsetUpgrade rust-docUpgrade rust-srcUpgrade clippyUpgrade cargo-c-debuginfoUpgrade rust-std-staticUpgrade rust-debuginfoUpgrade rustUpgrade libgit2-debugsourceUpgrade clippy-debuginfoUpgrade libgit2-develUpgrade cargo-cUpgrade libgit2-debuginfoUpgrade rust-debugger-commonUpgrade rust-toolset-srpm-macros | Aug 21, 2026 | Aug 20, 2026 |
| Debian | — | Upgrade libgit2 | Aug 23, 2026 | Aug 23, 2026 |
| Redhat_linux | — | No solution exists | Aug 25, 2026 | Aug 20, 2026 |
| Ubuntu | — | Upgrade libgit2-1.1 (Ubuntu Pro)Upgrade libgit2-26 (Ubuntu Pro)Upgrade libgit2-fixtures (Ubuntu Pro)Upgrade libgit2-28 (Ubuntu Pro)Upgrade libgit2-devUpgrade libgit2-0 (Ubuntu Pro)Upgrade libgit2-fixturesUpgrade libgit2-1.7Upgrade libgit2-1.9Upgrade libgit2-dev (Ubuntu Pro)Upgrade libgit2-24 (Ubuntu Pro)No solution exists | Aug 13, 2026 | Aug 12, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub