{"id":"CVE-2026-53584","title":"libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application","summary":"libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 does not reject traversal compon…","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","cwe":["CWE-22"],"published":"2026-08-20","updated":"2026-09-09","sourceUpdated":"2026-09-09T21:19:49.197","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-53584","references":[{"url":"https://github.com/libgit2/libgit2/commit/419637d3587396f5d139d6d88480eab3cd81e7a1","label":"security-advisories@github.com"},{"url":"https://github.com/libgit2/libgit2/commit/467c2d95ed663df722f83a5960edf568514b128c","label":"security-advisories@github.com"},{"url":"https://github.com/libgit2/libgit2/commit/ec7371da9f359cd8293e9108e7a0b1c1b61b67c4","label":"security-advisories@github.com"},{"url":"https://github.com/libgit2/libgit2/releases/tag/v1.8.6","label":"security-advisories@github.com"},{"url":"https://github.com/libgit2/libgit2/releases/tag/v1.9.5","label":"security-advisories@github.com"},{"url":"https://github.com/libgit2/libgit2/security/advisories/GHSA-cw77-j82w-mchm","label":"security-advisories@github.com"}],"tags":["nvd"],"epss":0.00328,"epssPercentile":0.26157,"ingestedAt":"2026-09-09T21:22:45.545Z","slug":"CVE-2026-53584","body":"## Overview\n\nlibgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 does not reject traversal components in a submodule path loaded from .gitmodules. The affected src/libgit2/submodule.c paths include git_submodule_lookup and git_submodule_add_setup. A crafted repository can specify a path such as ../escape-target, and applications that initialize the submodule can create directories outside the repository working tree. This issue is fixed in versions 1.8.6 and 1.9.5.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}