630 matches found
CVE-2026-106219
In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed reading local repositories on the server...
CVE-2026-106219
In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed reading local repositories on the server...
CVE-2026-106219
JetBrains TeamCity versions prior to 2026.2.1 are vulnerable to an information disclosure issue due to insufficient validation of Git submodule URLs . This flaw allows an attacker to perform unauthorized reading of local repositories hosted on the server. To remediate this vulnerability, users sh...
CVE-2026-106219: External Control of File Name or Path
In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed reading local repositories on the server...
PT-2026-106802
Name of the Vulnerable Software and Affected Versions JetBrains TeamCity versions prior to 2026.2.1 Description Insufficient validation of Git submodule URLs allows for the unauthorized reading of local repositories hosted on the server. Recommendations Update to version 2026.2.1...
Astra Linux – Vulnerability in Git
Git is a version control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, a specially crafted .gitmodules file with submodule URLs that were longer than 1024 characters could be used to exploit a bug in...
Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: drm/msm/dp: Resources are freed after they are unregistered. The unbind operation of the DP component iterates through the submodules to unregister them and clean up the situation. However, if the unbind occurs because the DP...
Astra Linux – Vulnerability in Git
Git is a fast, scalable, distributed revision control system with an unusually rich command set. It offers both high-level operations and full access to its internal workings. When reading a config value, Git removes any trailing carriage return and line feed CRLF characters. When writing a confi...
GHSA-59CR-6R3X-644W GitPython submodule update path traversal can write outside the repository
Affected: GitPython 3.1.61 latest release and main — git/objects/submodule/base.py. git diff 3.1.61 origin/main -- git/objects/submodule/ is empty, so both are identical here. --- The gap The fix for GHSA-hmq2-w58f-27jc added Submodule.validatedname and wired it into update and five siblings,...
GitPython submodule update path traversal can write outside the repository
Affected: GitPython 3.1.61 latest release and main — git/objects/submodule/base.py. git diff 3.1.61 origin/main -- git/objects/submodule/ is empty, so both are identical here. --- The gap The fix for GHSA-hmq2-w58f-27jc added Submodule.validatedname and wired it into update and five siblings,...
DEBIAN-CVE-2026-100689
GitPython before 3.1.62 does not validate the path field read from an untrusted .gitmodules file when updating submodules. While a prior fix GHSA-hmq2-w58f-27jc added Submodule.validatedname to constrain the name field, and GitPython's own containment guard Submodule.torelativepath is applied in...
UBUNTU-CVE-2026-100689
GitPython before 3.1.62 does not validate the path field read from an untrusted .gitmodules file when updating submodules. While a prior fix GHSA-hmq2-w58f-27jc added Submodule.validatedname to constrain the name field, and GitPython's own containment guard Submodule.torelativepath is applied in...
CVE-2026-100689
A flaw was found in GitPython. When updating submodules, GitPython fails to properly validate the submodule path specified in a repository's configuration file. A remote attacker could exploit this vulnerability by supplying a crafted repository containing directory traversal sequences in the...
CVE-2026-100689
GitPython before 3.1.62 does not validate the "path" field read from an untrusted .gitmodules file when updating submodules. While a prior fix GHSA-hmq2-w58f-27jc added Submodule.validatedname to constrain the "name" field, and GitPython's own containment guard Submodule.torelativepath is applied...
PT-2026-99360
Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.62 Description GitPython fails to validate the path field read from an untrusted .gitmodules file during submodule updates. While constraints exist for the name field and certain operations like add and move, th...
DRUPAL-CONTRIB-2026-161
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Webform includes a submodule called Webform Entity Print. This submodule doesn't sufficiently limit access to its print templates. When the submodule is enabled, a user...
PT-2026-97655
Name of the Vulnerable Software and Affected Versions Drupal Webform Entity Print submodule affected versions not specified Description The Webform Entity Print submodule does not sufficiently limit access to its print templates. A user with permissions to create and edit their own webforms can...
Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-161
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Webform includes a submodule called Webform Entity Print. This submodule doesn't sufficiently limit access to its print templates. When the submodule is enabled, a user...
Low: mount-s3
Issue Overview: libgit2 Submodule path traversal CVE-2026-53584 Affected Packages: mount-s3 Issue Correction: Run dnf update mount-s3 --releasever 2023.12.20260914 or dnf update --advisory ALAS2023-2026-2137 --releasever 2023.12.20260914 to update your system. More information on how to update yo...
Amazon Linux 2023 : mount-s3 (ALAS2023-2026-2137)
It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2137 advisory. libgit2 Submodule path traversal CVE-2026-53584 Tenable has extracted the preceding description block directly from the tested product security advisory. Note that Nessus has not tested for this issue...