CVE-2026-110860

Name	CVE-2026-110860
Description	GitPython from 3.1.62 before 3.2.0 contains a symlink-following flaw in Submodule.move(), which checks the destination only lexically and does not reject symbolic links in intermediate path components. An untrusted repository can commit a symlink such as vendor pointing outside the worktree, so an application moving an initialized submodule beneath it relocates the checkout externally and corrupts the index and .gitmodules.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-4872-1, DSA-6594-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
python-git (PTS)	bookworm	3.1.30-1+deb12u2	vulnerable
	bookworm (security)	3.1.30-1+deb12u3	fixed
	trixie	3.1.44-1	vulnerable
	trixie (security)	3.1.44-1+deb13u1	fixed
	forky, sid	3.2.1-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
python-git	source	bookworm	3.1.30-1+deb12u3	DLA-4872-1
python-git	source	trixie	3.1.44-1+deb13u1	DSA-6594-1
python-git	source	(unstable)	3.2.1-1

Notes

https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-gq48-pqfc-9p58
Fixed by: https://github.com/gitpython-developers/GitPython/commit/fb7e089ee0a3394c67057c11bb7f92682ac7960d (3.2.0)