Executive brief
libgit2 is a Git implementation library used in many applications to provide version control functionality. A vulnerability in submodule path handling allows a maliciously crafted repository to escape the repository directory and create files or directories outside the intended working tree, potentially enabling attackers to modify the host system or affect the integrity of dependent applications.
Technical details
libgit2 fails to validate that submodule paths in .gitmodules do not contain directory traversal components (such as "..") before loading them. The vulnerable functions git_submodule_lookup and git_submodule_add_setup in src/libgit2/submodule.c process attacker-controlled paths without escape validation. When a crafted repository specifies a submodule path like "../escape-target", the library will create directories outside the repository working tree when initializing the submodule. This is a path traversal vulnerability requiring no authentication but requiring the user to clone or initialize a malicious repository. Patches are available in versions 1.8.6 and 1.9.5, which add a path_is_valid check to ensure submodule paths stay within the repository boundary.
Affected products
- libgit2 libgit2 before 1.8.6 and 1.9.5
Timeline
- 2026-08-20: disclosed
- 2026-06-01: patched: Fix committed to main branch