{"id":"DEBIAN-CVE-2026-110860","details":"GitPython from 3.1.62 before 3.2.0 contains a symlink-following flaw in Submodule.move(), which checks the destination only lexically and does not reject symbolic links in intermediate path components. An untrusted repository can commit a symlink such as vendor pointing outside the worktree, so an application moving an initialized submodule beneath it relocates the checkout externally and corrupts the index and .gitmodules.","modified":"2026-10-15T12:00:06.873550785Z","published":"2026-10-14T23:17:27.340Z","upstream":["CVE-2026-110860"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2026-110860"}],"affected":[{"package":{"name":"python-git","ecosystem":"Debian:12","purl":"pkg:deb/debian/python-git?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.30-1","3.1.30-1+deb12u2","3.1.36-1","3.1.37-1","3.1.37-2","3.1.37-3","3.1.44-1","3.1.45-1","3.1.46-1","3.1.50-1","3.1.61-1","3.1.62-1","3.1.62-2","3.1.62-3"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-110860.json"}},{"package":{"name":"python-git","ecosystem":"Debian:13","purl":"pkg:deb/debian/python-git?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.44-1","3.1.45-1","3.1.46-1","3.1.50-1","3.1.61-1","3.1.62-1","3.1.62-2","3.1.62-3"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-110860.json"}},{"package":{"name":"python-git","ecosystem":"Debian:14","purl":"pkg:deb/debian/python-git?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.44-1","3.1.45-1","3.1.46-1","3.1.50-1","3.1.61-1","3.1.62-1","3.1.62-2","3.1.62-3"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-110860.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L"}]}