GHSA-cw77-j82w-mchm
CVE Information
Impact
A crafted repository with a submodule whose path contains traversal components (e.g. "../") can cause the library to create directories outside the repository's working tree.
Users of libgit2 who initialize a submodule in a crafted repository will be affected.
Patches
This is patched in libgit2 v1.9.5 and v1.8.6.
Credits
This issue was responsibly disclosed by Michał Majchrowicz and Marcin Wyczechowski, members of the AFINE Team.