This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-53584 →

DEBIAN-CVE-2026-53584

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality in...

Original description

The description as published by the source.

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 does not reject traversal components in a submodule path loaded from .gitmodules. The affected src/libgit2/submodule.c paths include git_submodule_lookup and git_submodule_add_setup. A crafted repository can specify a path such as ../escape-target, and applications that initialize the submodule can create directories outside the repository working tree. This issue is fixed in versions 1.8.6 and 1.9.5.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 libgit2

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.1+ds-1+deb12u2"}]}]

Debian:13 libgit2

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0+ds-2+deb13u1"}]}]

Debian:14 libgit2

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.6+ds-1"}]}]

References

advisory security-tracker.debian.org