CVE-2026-110860
MEDIUM
MEDIUM
Priority: 0.01
BB Relevance:
39/100
Published: 2026-10-14
Modified: 2026-10-26
First seen: 2026-10-29
Status: active
Attack Surface
Low Complexity
No Auth
Integ. Impact
CVSS Vector Breakdown
AV:
Local
AC:
Low
PR:
None
UI:
Passive
AT:
None
VC:
None
VI:
High
VA:
Low
Description
GitPython from 3.1.62 before 3.2.0 contains a symlink-following flaw in Submodule.move(), which checks the destination only lexically and does not reject symbolic links in intermediate path components. An untrusted repository can commit a symlink such as vendor pointing outside the worktree, so an application moving an initialized submodule beneath it relocates the checkout externally and corrupts the index and .gitmodules.