libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality… (CVE-2026-53584)

libgit2 versions before 1.8.6 and 1.9.5 do not properly reject traversal components in submodule paths loaded from .gitmodules. Specifically, functions git_submodule_lookup and git_submodule_add_setup in src/libgit2/submodule.c are affected. A crafted repository can specify a path such as '../escape-target', which may cause applications that initialize the submodule to create directories outside the intended repository working tree. This vulnerability is addressed in libgit2 versions 1.8.6 and 1.9.5. Multiple Ubuntu package versions are affected, and Ubuntu has released security notices with patches.

A remote attacker can craft a repository with malicious submodule paths containing directory traversal sequences, potentially causing applications using libgit2 to create directories outside the repository working tree. This could lead to unauthorized file system modifications. The CVSS score is 4.3 (medium severity), indicating limited impact primarily related to integrity. No known exploits in the wild have been reported.

A fix is available and users should update libgit2 to versions 1.8.6 or 1.9.5 or later. Ubuntu has released security updates for affected package versions, detailed in Ubuntu Security Notice USN-8628-1. Applying these official patches or performing a standard system update will remediate the issue. No additional mitigation actions are required beyond applying the vendor-provided fixes.