CVE-2026-53584
Fixed in a distro release EPSS <1%CVSS 4.3
libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 does not reject traversal components in a submodule path loaded from .gitmodules. The affected src/libgit2/submodule.c paths include git_submodule_lookup and git_submodule_add_setup. A crafted repository can specify a path such as ../escape-target, and applications that initialize the submodule can create directories outside the repository working tree. This issue is fixed in versions 1.8.6 and 1.9.5.
Products: libgit2
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2 | cargo | 1.97.0-2.amzn2 |
| Amazon Linux 2 | clippy | 1.97.0-2.amzn2 |
| Amazon Linux 2 | rust | 1.97.0-2.amzn2 |
| Amazon Linux 2 | rust-analyzer | 1.97.0-2.amzn2 |
| Amazon Linux 2 | rust-debugger-common | 1.97.0-2.amzn2 |
| Amazon Linux 2 | rust-doc | 1.97.0-2.amzn2 |
| Amazon Linux 2 | rust-gdb | 1.97.0-2.amzn2 |
| Amazon Linux 2 | rust-src | 1.97.0-2.amzn2 |
| Amazon Linux 2 | rust-std-static | 1.97.0-2.amzn2 |
| Amazon Linux 2 | rust-toolset | 1.97.0-2.amzn2 |
| Amazon Linux 2 | rust-toolset-srpm-macros | 1.97.0-2.amzn2 |
| Amazon Linux 2 | rustfmt | 1.97.0-2.amzn2 |
| Amazon Linux 2023 | cargo | 1.97.0-2.amzn2023 |
| Amazon Linux 2023 | cargo-c | 0.10.21-1.amzn2023.0.1 |
| Amazon Linux 2023 | clippy | 1.97.0-2.amzn2023 |
| Amazon Linux 2023 | libgit2 | 1.6.4-116.amzn2023 |
| Amazon Linux 2023 | libgit2-devel | 1.6.4-116.amzn2023 |
| Amazon Linux 2023 | mount-s3 | 1.24.0-1.amzn2023 |
| Amazon Linux 2023 | rust | 1.97.0-2.amzn2023 |
| Amazon Linux 2023 | rust-analyzer | 1.97.0-2.amzn2023 |
| Amazon Linux 2023 | rust-debugger-common | 1.97.0-2.amzn2023 |
| Amazon Linux 2023 | rust-doc | 1.97.0-2.amzn2023 |
| Amazon Linux 2023 | rust-gdb | 1.97.0-2.amzn2023 |
| Amazon Linux 2023 | rust-lldb | 1.97.0-2.amzn2023 |
| Amazon Linux 2023 | rust-src | 1.97.0-2.amzn2023 |
| Amazon Linux 2023 | rust-std-static | 1.97.0-2.amzn2023 |
| Amazon Linux 2023 | rust-std-static-wasm32-unknown-unknown | 1.97.0-2.amzn2023 |
| Amazon Linux 2023 | rust-std-static-wasm32-wasip1 | 1.97.0-2.amzn2023 |
| Amazon Linux 2023 | rust-toolset | 1.97.0-2.amzn2023 |
| Amazon Linux 2023 | rust-toolset-srpm-macros | 1.97.0-2.amzn2023 |
| Amazon Linux 2023 | rustfmt | 1.97.0-2.amzn2023 |
| Debian 12 | libgit2 | 1.5.1+ds-1+deb12u2 |
| Debian 13 | libgit2 | 1.9.0+ds-2+deb13u1 |
| Debian 14 | libgit2 | 1.9.6+ds-1 |
| Red Hat hummingbird 1 | libgit2 | 0:1.9.7-1.hum1 |
| Red Hat hummingbird 1 | libgit2-devel | 0:1.9.7-1.hum1 |
| Ubuntu 24.04 LTS | libgit2 | 1.7.2+ds-1ubuntu3.1 |
| Ubuntu 26.04 LTS | libgit2 | 1.9.1+ds-1ubuntu1.1 |
| Ubuntu Pro 14.04 LTS | libgit2 | no fix |
| Ubuntu Pro 14.04 LTS | libgit2 | 0.19.0-2ubuntu0.4+esm2 |
| Ubuntu Pro 16.04 LTS | libgit2 | no fix |
| Ubuntu Pro 16.04 LTS | libgit2 | 0.24.1-2ubuntu0.2+esm3 |
| Ubuntu Pro 18.04 LTS | libgit2 | no fix |
| Ubuntu Pro 18.04 LTS | libgit2 | 0.26.0+dfsg.1-1.1ubuntu0.2+esm2 |
| Ubuntu Pro 20.04 LTS | libgit2 | 0.28.4+dfsg.1-2ubuntu0.1+esm1 |
| Ubuntu Pro 22.04 LTS | libgit2 | 1.1.0+dfsg.1-4.1ubuntu0.1+esm1 |
| openSUSE Tumbleweed | libgit2 | 1.9.6-1.1 |