Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-110860— GitPython 3.1.62 before 3.2.0 Symlink Path Traversal via Submodule.move()

Quick assessment

Affected
gitpython-developers GitPython
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 GitPython 3.1.62 至 3.2.0（不含 3.2.0）版本中，Submodule.move() 方法存在一个符号链接跟随缺陷。该缺陷表现为：该方法仅对目标路径进行词法检查，未能在路径中间组件中拒绝符号链接。因此，不受信任的仓库可提交一个指向工作树外部的符号链接（例如名为 vendor 的符号链接），导致应用在该符号链接下移动已初始化的子模块时，将检出文件重新定位到工作树外部，从而破坏索引和 .gitmodules 文件。

CVSS 6.1 · Medium EPSS 0.13% · P2

Possible ATT&CK Techniques 1 AI

T1408

Affected Version Matrix 2

VendorProduct Version RangeStatus
gitpython-developers GitPython 3.1.62< 3.2.0 affected
3.2.0 unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-110860

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
GitPython 3.1.62 before 3.2.0 Symlink Path Traversal via Submodule.move()
Source: CVE Program / CVE List V5
Vulnerability Description
GitPython from 3.1.62 before 3.2.0 contains a symlink-following flaw in Submodule.move(), which checks the destination only lexically and does not reject symbolic links in intermediate path components. An untrusted repository can commit a symlink such as vendor pointing outside the worktree, so an application moving an initialized submodule beneath it relocates the checkout externally and corrupts the index and .gitmodules.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
在文件访问前对链接解析不恰当(链接跟随)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
gitpython-developers GitPython 3.1.62 ~ 3.2.0 -

II. Public POCs for CVE-2026-110860

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-110860

请登录查看更多情报信息。

Other References for CVE-2026-110860 (2)

Same Patch Batch · gitpython-developers · 2026-10-14 · 6 CVEs total

CVE-2026-110858 8.1 HIGH GitPython 3.1.30 before 3.2.0 Command Injection via Remote.pull() Refspec
CVE-2026-110856 7.5 HIGH GitPython before 3.2.0 ReDoS via _re_actor_epoch in parse_actor_and_date
CVE-2026-110859 7.5 HIGH GitPython before 3.2.0 Arbitrary File Read via Head.checkout() Branch Name
CVE-2026-110857 7.5 HIGH GitPython before 3.2.0 Command Execution via ls_remote ext:: URLs
CVE-2026-110855 6.5 MEDIUM GitPython before 3.2.0 Environment Variable Disclosure via .gitmodules Submodule Name

IV. Related Vulnerabilities

Same product: GitPython
Same vendor: gitpython-developers
Same weakness: CWE-59

V. Comments for CVE-2026-110860

No comments yet

Leave a comment