Description

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 does not reject traversal components in a submodule path loaded from .gitmodules. The affected src/libgit2/submodule.c paths include git_submodule_lookup and git_submodule_add_setup. A crafted repository can specify a path such as ../escape-target, and applications that initialize the submodule can create directories outside the repository working tree. This issue is fixed in versions 1.8.6 and 1.9.5.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-20T19:16:54.680Z",
  "pubdate": "2026-08-20T19:16:54.680Z",
  "executiveSummary": "A path traversal vulnerability exists within the libgit2 library, specifically affecting versions prior to 1.8.6 and 1.9.5.\nThe vulnerability arises due to the failure of libgit2 to properly reject directory traversal components (such as relative path sequences like ../) when processing submodule paths loaded from a repository's .gitmodules file.\nIf an application utilizes vulnerable functions such as git_submodule_lookup or git_submodule_add_setup to handle a maliciously crafted Git repository, an attacker can specify arbitrary escape targets.\nUpon initialization of the submodule, the application will create directories outside the intended repository working tree, leading to arbitrary file system writes.\nThis vulnerability poses a significant risk to systems processing untrusted repositories, potentially allowing attackers with the ability to supply a crafted repository to manipulate files and directories on the host operating system under the security context of the running application.\nSuccessful exploitation requires the victim to clone or interact with a maliciously crafted repository using an application built upon an affected version of libgit2.",
  "technicalDetails": "The root cause of this vulnerability lies in insufficient input validation within the submodule path parsing and handling logic of libgit2. Specifically, functions responsible for submodule management in src/libgit2/submodule.c, including git_submodule_lookup and git_submodule_add_setup, fail to sanitize or validate submodule paths against directory traversal sequences.\nIn a standard Git repository, the .gitmodules file defines submodules and maps their logical names to relative repository paths within the working tree. libgit2 parses these configurations to facilitate submodule operations.\nBecause the library does not strip or reject relative traversal components such as ../, an attacker can author a malicious .gitmodules file containing a crafted path pointing to locations external to the working directory, such as ../escape-target.\nThe attack flow proceeds as follows: First, the victim obtains or clones the crafted Git repository containing the malicious .gitmodules payload. Second, the victim invokes an application utilizing libgit2 that executes git_submodule_lookup or git_submodule_add_setup on the repository. Third, libgit2 parses the submodule configuration without enforcing boundary checks on the path parameter. Fourth, during the submodule initialization or setup phase, the file system operations resolve the traversal path relative to the working tree. Consequently, the application inadvertently creates directories and potentially writes files outside the designated repository boundaries, dictated by the permissions of the user executing the application.\nThe vulnerability affects libgit2 versions prior to 1.8.6 and 1.9.5. No special authentication or privilege requirements are needed beyond the user executing the vulnerable application against the hostile repository. The network exposure depends entirely on the application's attack surface for processing untrusted repositories (e.g., automated CI/CD pipelines, Git repository hosting platforms, or desktop developer tools).\nPost-exploitation impact includes unauthorized file system modifications, creation of arbitrary directory structures outside the working tree, and potential cascading impacts if critical system or application files are overwritten or manipulated."
}