Threats tagged 'brew-fdroidserver-cve-2026-110860'

GitPython's Submodule.move() API does not properly validate symbolic links in the destination path, allowing an attacker-controlled symlink in a cloned repository to redirect the move operation outside the intended worktree. This can cause the submodule checkout to be moved to an attacker-selected external directory, corrupting the parent repository's index and configuration. The issue affects GitPython 3.1.62 and current main branch, and requires the application to explicitly call Submodule.move() with a path under the symlink. No code execution or confidentiality impact is demonstrated.