CVE-2026-110860 GitPython 3.1.62 before 3.2.0 Symlink Path Traversal via Submodule.move()

GitPython from 3.1.62 before 3.2.0 contains a symlink-following flaw in Submodule.move, which checks the destination only lexically and does not reject symbolic links in intermediate path components. An untrusted repository can commit a symlink such as vendor pointing outside the worktree, so an...

CVE-2026-110860 GitPython 3.1.62 before 3.2.0 Symlink Path Traversal via Submodule.move()

GitPython from 3.1.62 before 3.2.0 contains a symlink-following flaw in Submodule.move, which checks the destination only lexically and does not reject symbolic links in intermediate path components. An untrusted repository can commit a symlink such as vendor pointing outside the worktree, so an...