CVE-2026-110860

The record

GitPython from 3.1.62 before 3.2.0 contains a symlink-following flaw in Submodule.move(), which checks the destination only lexically and does not reject symbolic links in intermediate path components. An untrusted repository can commit a symlink such as vendor pointing outside the worktree, so an application moving an initialized submodule beneath it relocates the checkout externally and corrupts the index and .gitmodules.

Affected packages

Related vulnerabilities

• CVE-2026-119336 Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing… CWE-59
• CVE-2026-119334 Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing… CWE-59
• CVE-2026-116250 In server mode pgAdmin 4 validates a path a user gives for a file in their storage… CWE-59
• CVE-2026-119704 Bastille through 1.4.4 contains a symlink following vulnerability in the cp.sh, rcp.sh… CWE-59
• CVE-2026-119291 Zuke is a code-first, strongly typed build automation system for Deno. CWE-59
• CVE-2026-118990 CallBackery versions before 0.62.0 for Perl leave a world-readable dump of the… CWE-59
• CVE-2026-119364 ProFTPD through 1.3.9e and 1.3.10rc1 through 1.3.10rc4 contains a link-following… CWE-59
• CVE-2026-119168 HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during… CWE-59