The vulnerability resides in libgit2's handling of submodule paths defined in a repository’s .gitmodules file. A .gitmodules entry such as "../escape-target" is accepted without sanitization. When an application uses git_submodule_lookup or git_submodule_add_setup to initialize the submodule, the library will create directories relative to the current working tree, potentially outside the intended repository boundary. This enables an attacker to cause file system writes beyond the repository tree, violating isolation assumptions. The primary impact is a directory traversal that can lead to tampering with files outside the repository, a risk that could expose sensitive data or alter system behavior. This weakness is categorized as CWE-22, a classic path traversal flaw.

The affected product is libgit2 by libgit2, a portable C library providing Git functionality. The vulnerability exists in all versions prior to 1.8.6 and 1.9.5. These releases and earlier ones do not reject traversal components in a submodule path.

The CVSS score of 4.3 indicates a medium severity. No EPSS data is provided. The vulnerability is not listed in CISA KEV. Exploitation requires an application to process a crafted repository that contains a .gitmodules file with a traversal component. An attacker can execute this by hosting a malicious repository or by supplying one to an untrusted application that clones or pulls from external sources. Once the vulnerable library initializes the submodule, it will create directories outside the repository working tree, allowing the attacker to write files, potentially overwrite critical files or drop malicious payloads. The attack vector is therefore likely remote in the sense of a malicious repository delivered over the network, but it can also be local if the developer or build system pulls untrusted content. The possibility of compromising the host filesystem depends on the application’s privileges.