Symlink-Following Vulnerability in GitPython Affects GitHub Repository Management
CVE-2026-110860

6.9MEDIUM

Key Information:

Vendor

Gitpython-developers

Status
Gitpython
Vendor
CVE Published:
14 October 2026

What is CVE-2026-110860?

GitPython versions prior to 3.2.0 contain a symlink-following flaw in the Submodule.move() method. This vulnerability affects how the method checks the destination path, allowing symbolic links in intermediate components to be unvalidated. When an untrusted repository introduces a symlink, such as pointing to a vendor directory outside the worktree, any application that utilizes the Submodule.move() method could inadvertently move an initialized submodule. This situation results in the checkout being relocated outside the intended directory, leading to potential index corruption and issues with the .gitmodules file.

Affected Version(s)

GitPython 3.1.62 < 3.2.0

GitPython 3.2.0

References

https://github.com/gitpython-developers/GitPython/securit...
vendor-advisory
https://www.vulncheck.com/advisories/gitpython-3.1.62-bef...
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

dpfkdlemtp
.