CVE-2026-53584
libgit2: Submodule path traversal
libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 does not reject traversal components in a submodule path loaded from .gitmodules. The affected src/libgit2/submodule.c paths include git_submodule_lookup and git_submodule_add_setup. A crafted repository can specify a path such as ../escape-target, and applications that initialize the submodule can create directories outside the repository working tree. This issue is fixed in versions 1.8.6 and 1.9.5.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
libgit2: Submodule path traversal
libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 does not reject traversal components in a submodule path loaded from .gitmodules. The affected src/libgit2/submodule.c paths include git_submodule_lookup and git_submodule_add_setup. A crafted repository can specify a path such as ../escape-target, and applications that initialize the submodule can create directories outside the repository working tree. This issue is fixed in versions 1.8.6 and 1.9.5.
- Record
CVE-2026-53584- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
EUVDEUVD-2026-63546
libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 does not reject traversal components in a submodule path loaded from .gitmodules. The affected src/libgit2/submodule.c paths include git_submodule_lookup and git_submodule_add_setup. A crafted repository can specify a path such as ../escape-target, and applications that initialize the submodule can create directories outside the repository working tree. This issue is fixed in versions 1.8.6 and 1.9.5.
- Record
EUVD-2026-63546- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
NVD
libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 does not reject traversal components in a submodule path loaded from .gitmodules. The affected src/libgit2/submodule.c paths include git_submodule_lookup and git_submodule_add_setup. A crafted repository can specify a path such as ../escape-target, and applications that initialize the submodule can create directories outside the repository working tree. This issue is fixed in versions 1.8.6 and 1.9.5.
- Record
CVE-2026-53584- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVALPINE-CVE-2026-53584
libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 does not reject traversal components in a submodule path loaded from .gitmodules. The affected src/libgit2/submodule.c paths include git_submodule_lookup and git_submodule_add_setup. A crafted repository can specify a path such as ../escape-target, and applications that initialize the submodule can create directories outside the repository working tree. This issue is fixed in versions 1.8.6 and 1.9.5.
- Record
ALPINE-CVE-2026-53584- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Updated
- 2026-11-03
OSVBELL-CVE-2026-53584
- Record
BELL-CVE-2026-53584- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSV
libgit2: Submodule path traversal
libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 does not reject traversal components in a submodule path loaded from .gitmodules. The affected src/libgit2/submodule.c paths include git_submodule_lookup and git_submodule_add_setup. A crafted repository can specify a path such as ../escape-target, and applications that initialize the submodule can create directories outside the repository working tree. This issue is fixed in versions 1.8.6 and 1.9.5.
- Record
CVE-2026-53584- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
Show 7 moreShow less
OSVDEBIAN-CVE-2026-53584
libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 does not reject traversal components in a submodule path loaded from .gitmodules. The affected src/libgit2/submodule.c paths include git_submodule_lookup and git_submodule_add_setup. A crafted repository can specify a path such as ../escape-target, and applications that initialize the submodule can create directories outside the repository working tree. This issue is fixed in versions 1.8.6 and 1.9.5.
- Record
DEBIAN-CVE-2026-53584- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVJLSEC-2026-1370
libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 does not reject traversal components in a submodule path loaded from .gitmodules. The affected src/libgit2/submodule.c paths include git_submodule_lookup and git_submodule_add_setup. A crafted repository can specify a path such as ../escape-target, and applications that initialize the submodule can create directories outside the repository working tree. This issue is fixed in versions 1.8.6 and 1.9.5.
- Record
JLSEC-2026-1370- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVRHSA-2026:59361
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
- Record
RHSA-2026:59361- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-53584
libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 does not reject traversal components in a submodule path loaded from .gitmodules. The affected src/libgit2/submodule.c paths include git_submodule_lookup and git_submodule_add_setup. A crafted repository can specify a path such as ../escape-target, and applications that initialize the submodule can create directories outside the repository working tree. This issue is fixed in versions 1.8.6 and 1.9.5.
- Record
UBUNTU-CVE-2026-53584- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVAZL-96974 No score
CVE-2026-53584 affecting package libgit2 for versions less than 1.7.2-3
libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 does not reject traversal components in a submodule path loaded from .gitmodules. The affected src/libgit2/submodule.c paths include git_submodule_lookup and git_submodule_add_setup. A crafted repository can specify a path such as ../escape-target, and applications that initialize the submodule can create directories outside the repository working tree. This issue is fixed in versions 1.8.6 and 1.9.5.
- Record
AZL-96974- Updated
- 2026-11-05
OSVMGASA-2026-0570 No score
Updated libgit2 package fixes security vulnerabilities
Inverted IP SubjectAltName Comparison in OpenSSL Backend. (CVE-2026-53583) Submodule path traversal. (CVE-2026-53584) Unbounded Memory Allocation via Delta Object Result-Size Header. (CVE-2026-53585) HTTP transport can leak credentials to an offsite redirect target. (CVE-2026-53586) Unauthenticated network-reachable heap out-of-bounds read in transports/smart_pkt.c:set_data. (CVE-2026-53587) Shell Command Injection via ssh_libssh2 Backend. (CVE-2026-5917)
- Record
MGASA-2026-0570- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11315-1 No score
libgit2-1_9-1.9.6-1.1 on GA media
These are all security issues fixed in the libgit2-1_9-1.9.6-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11315-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libgit2Alpine:v3.23 |
before 1.9.6-r0 | 1.9.6-r0 |
libgit2Alpine:v3.24 |
before 1.9.6-r0 | 1.9.6-r0 |
libgit2Azure Linux:3 |
before 1.7.2-3 | 1.7.2-3 |
libgit2Alpaquita:25 |
1.9.0-r2 up to 1.9.6-r0 | 1.9.6-r0 |
libgit2Alpaquita:stream |
1.7.1-r0 up to 1.9.6-r0 | 1.9.6-r0 |
libgit2Debian:12 |
before 1.5.1+ds-1+deb12u2, plus listed versions 1.5.1+ds-11.5.1+ds-1+deb12u1 |
1.5.1+ds-1+deb12u2 |
libgit2Debian:13 |
before 1.9.0+ds-2+deb13u1, plus listed versions 1.9.0+ds-2 |
1.9.0+ds-2+deb13u1 |
libgit2Debian:14 |
before 1.9.6+ds-1, plus listed versions 1.9.0+ds-21.9.1+ds-11.9.2+ds-11.9.2+ds-21.9.2+ds-3 Show 8 moreShow less1.9.2+ds-41.9.2+ds-51.9.2+ds-61.9.2+ds-71.9.2+ds-81.9.2+ds-91.9.3+ds-11.9.4+ds-1 |
1.9.6+ds-1 |
LibGit2_jllJulia |
before 1.9.6+0 | 1.9.6+0 |
libgit2Mageia:10 From an advisory covering 6 CVEs |
before 1.9.2-1.1.mga10 | 1.9.2-1.1.mga10 |
Show 10 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libgit2Red Hat:hummingbird:1 From an advisory covering 5 CVEs |
before 0:1.9.7-1.hum1 | 0:1.9.7-1.hum1 |
libgit2-develRed Hat:hummingbird:1 From an advisory covering 5 CVEs |
before 0:1.9.7-1.hum1 | 0:1.9.7-1.hum1 |
libgit2Ubuntu:Pro:14.04:LTS |
All versions, plus listed versions 0.19.0-20.19.0-2ubuntu0.40.19.0-2ubuntu0.4+esm10.19.0-2ubuntu0.4+esm2 |
None known |
libgit2Ubuntu:Pro:16.04:LTS |
All versions, plus listed versions 0.22.2-20.23.1-10.24.1-20.24.1-2ubuntu0.20.24.1-2ubuntu0.2+esm10.24.1-2ubuntu0.2+esm20.24.1-2ubuntu0.2+esm30.24.1-2ubuntu0.2+esm4 |
None known |
libgit2Ubuntu:Pro:18.04:LTS |
All versions, plus listed versions 0.25.1+really0.24.6-10.26.0+dfsg.1-1.10.26.0+dfsg.1-1.1build10.26.0+dfsg.1-1.1ubuntu0.20.26.0+dfsg.1-1.1ubuntu0.2+esm10.26.0+dfsg.1-1.1ubuntu0.2+esm20.26.0+dfsg.1-1.1ubuntu0.2+esm3 |
None known |
libgit2Ubuntu:Pro:20.04:LTS |
before 0.28.4+dfsg.1-2ubuntu0.1+esm1, plus listed versions 0.27.7+dfsg.1-0.2build10.28.3+dfsg.1-10.28.3+dfsg.1-1ubuntu10.28.4+dfsg.1-20.28.4+dfsg.1-2ubuntu0.1 |
0.28.4+dfsg.1-2ubuntu0.1+esm1 |
libgit2Ubuntu:Pro:22.04:LTS |
before 1.1.0+dfsg.1-4.1ubuntu0.1+esm1, plus listed versions 1.1.0+dfsg.1-41.1.0+dfsg.1-4.11.1.0+dfsg.1-4.1build11.1.0+dfsg.1-4.1ubuntu0.1 |
1.1.0+dfsg.1-4.1ubuntu0.1+esm1 |
libgit2Ubuntu:24.04:LTS |
before 1.7.2+ds-1ubuntu3.1, plus listed versions 1.5.1+ds-1ubuntu11.7.1+ds-2ubuntu11.7.2+ds-1ubuntu11.7.2+ds-1ubuntu21.7.2+ds-1ubuntu3 |
1.7.2+ds-1ubuntu3.1 |
libgit2Ubuntu:26.04:LTS |
before 1.9.1+ds-1ubuntu1.1, plus listed versions 1.9.0+ds-2ubuntu21.9.1+ds-1ubuntu1 |
1.9.1+ds-1ubuntu1.1 |
libgit2openSUSE:Tumbleweed From an advisory covering 5 CVEs |
before 1.9.6-1.1 | 1.9.6-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | OSV | |
| affected, aliases, references | OSV | |
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-53584 is a medium vulnerability (CVSS 4.3) in Libgit2, published July 20, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.33%, the 26th percentile. Fixed in libgit2 1.9.6-r0.
References
github.com/libgit2/libgit2/security/advisories/GHSA-cw77-j82w-mchm
Show 56 moreShow less
security.alpinelinux.org/vuln/CVE-2026-53584
nvd.nist.gov/vuln/detail/CVE-2026-53584
docs.bell-sw.com/security/cves/CVE-2026-53584
security-tracker.debian.org/tracker/CVE-2026-53584
advisories.mageia.org/MGASA-2026-0570.html
bugs.mageia.org/show_bug.cgi?id=35993
lists.opensuse.org/archives/list/[email protected]/message/VHH635RSSSNGD55XOG7MSUBAC6CK77E2
openwall.com/lists/oss-security/2026/08/20/4
ubuntu.com/security/notices/USN-8628-1
lists.debian.org/debian-security-announce/2026/msg00364.html
access.redhat.com/errata/RHSA-2026:59361
images.redhat.com
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_59361.json
bugzilla.redhat.com/show_bug.cgi?id=2520694
cve.org/CVERecord?id=CVE-2026-53583
suse.com/security/cve/CVE-2026-53583