CVE-2026-110860: GitPython 3.1.62 before 3.2.0 Symlink Path Traversal via Submodule.move()
GitPython from 3.1.62 before 3.2.0 contains a symlink-following flaw in Submodule.move(), which checks the destination only lexically and does not reject symbolic links in intermediate path components. An untrusted repository can commit a symlink such as vendor pointing outside the worktree, so an application moving an initialized submodule beneath it relocates the checkout externally and corrupts the index and .gitmodules.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using GitPython versions from 3.1.62 before 3.2.0 are exposed when they operate on an untrusted repository and move an initialized submodule to a destination whose path includes attacker-controlled symbolic links.
What does an attacker need to exploit it?
An attacker needs to provide a repository containing a symbolic link in an intermediate destination-path component, such as a vendor link pointing outside the worktree, and induce the application to call Submodule.move() beneath that path. User interaction is required according to the supplied severity vector.
What is the impact of a successful exploit?
The submodule checkout can be relocated outside the worktree. The operation can also corrupt the repository index and .gitmodules.
What can be done if upgrading is not immediately possible?
Do not run Submodule.move() on repositories or destination paths that are untrusted. In particular, inspect and reject symbolic links in every intermediate component of the intended destination path before moving a submodule.