CVE-2026-53584

MEDIUM 4.3

libgit2: Submodule path traversal

CVSS Score

4.3

EPSS Score

0.0%

EPSS Percentile

0th

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 does not reject traversal components in a submodule path loaded from .gitmodules. The affected src/libgit2/submodule.c paths include git_submodule_lookup and git_submodule_add_setup. A crafted repository can specify a path such as ../escape-target, and applications that initialize the submodule can create directories outside the repository working tree. This issue is fixed in versions 1.8.6 and 1.9.5.

CWE	CWE-22
Vendor	libgit2
Product	libgit2
Published	Aug 20, 2026
Last Updated	Aug 20, 2026

Stay Ahead of the Next One

Get instant alerts for libgit2 libgit2

Be the first to know when new medium vulnerabilities affecting libgit2 libgit2 are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Affected Versions

libgit2 / libgit2

< 1.8.6 >= 1.9.0, < 1.9.5

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/libgit2/libgit2/security/advisories/GHSA-cw77-j82w-mchm github.com: https://github.com/libgit2/libgit2/commit/419637d3587396f5d139d6d88480eab3cd81e7a1 github.com: https://github.com/libgit2/libgit2/commit/467c2d95ed663df722f83a5960edf568514b128c github.com: https://github.com/libgit2/libgit2/commit/ec7371da9f359cd8293e9108e7a0b1c1b61b67c4 github.com: https://github.com/libgit2/libgit2/releases/tag/v1.8.6 github.com: https://github.com/libgit2/libgit2/releases/tag/v1.9.5