CVE-2026-53584
libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 does not reject traversal components in a submodule path loaded from .gitmodules. The affected src/libgit2/submodule.c paths include git_submodule_lookup and git_submodule_add_setup. A crafted repository can specify a path such as ../escape-target, and applications that initialize the submodule can create directories outside the repository working tree. This issue is fixed in versions 1.8.6 and 1.9.5.
CSIRTS triage
- What
- libgit2 allows path traversal via maliciously crafted submodule paths during repository operations.
- Who is affected
- Repositories with untrusted submodule configurations or systems cloning untrusted repositories.
- Urgency
- Medium severity (CVSS 4.3) and not exploited; standard patch deployment is appropriate.
- Action
- Update libgit2 to a version that validates and sanitizes submodule paths to prevent directory traversal.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch CVE-2026-53584
Get an email if CVE-2026-53584 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.33% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 25% of all EPSS-scored CVEs.
Advisory coverage (4)
- mediumCVE-2026-53584: libgit2 is a portable C implementation of the Git core methods provided as a linkable library …nvd · 2026-08-20
- lowDSA-6453-1 libgit2 - security updatedebian · 2026-08-20
- unknownUSN-8628-1: libgit2 vulnerabilitiesubuntu · 2026-08-12
- mediumCVE-2026-53584: libgit2: Submodule path traversalmsrc · 2026-08-11
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-53584)