CVE-2026-53584: libgit2: Submodule path traversal
Last updated 13 August 2026
Other sources
libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 does not reject traversal components in a submodule path loaded from .gitmodules. The affected src/libgit2/submodule.c paths include gitsubmodulelookup and gitsubmoduleaddsetup. A crafted repository can specify a path such as ../escape-target, and applications that initialize the submodule can create directories outside the repository working tree. This issue is fixed in versions 1.8.6 and 1.9.5.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libgit2to a version that resolves this vulnerability.Fixed in 1.9.6+ds-1 - Upgrade
Upgrade
libgit2to a version that resolves this vulnerability.Fixed in 1.8.6 - Upgrade
Upgrade
libgit2to a version that resolves this vulnerability.Fixed in 1.9.5
Event History
Frequently Asked Questions
Which applications are exposed?
Applications that use libgit2 versions earlier than 1.8.6 or 1.9.5 and initialize submodules from a crafted repository are exposed. The affected code paths include git_submodule_lookup and git_submodule_add_setup.
What must an attacker provide to exploit this issue?
An attacker needs to provide a crafted repository whose .gitmodules file contains a submodule path with traversal components, such as ../escape-target. Exploitation requires a user or application to initialize that submodule.
What is the impact when exploitation succeeds?
The application can create directories outside the repository working tree. The supplied severity vector indicates integrity impact but no confidentiality or availability impact.
What should be done if upgrading cannot happen immediately?
Do not initialize submodules from untrusted repositories, or inspect .gitmodules before doing so and reject submodule paths containing traversal components. Upgrade to libgit2 1.8.6 or 1.9.5 when possible.