What is GHSA-cfp4-478m-4f52?

GHSA-cfp4-478m-4f52 is a security advisory published by GitHub Security Advisories with Medium severity. GitPython from 3.1.62 before 3.2.0 contains a symlink-following flaw in Submodule.move(), which...

Which CVE IDs does GHSA-cfp4-478m-4f52 cover?

GHSA-cfp4-478m-4f52 covers the following CVE IDs: CVE-2026-110860. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-cfp4-478m-4f52?

GHSA-cfp4-478m-4f52 has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

GHSA-cfp4-478m-4f52MediumCVSS 6.1

GitPython from 3.1.62 before 3.2.0 contains a symlink-following flaw in Submodule.move(), which...

Vendor

GitHub Security Advisories

Published

October 15, 2026

Last Modified

October 15, 2026

🔗 CVE IDs covered (1)

CVE-2026-110860 →

📋 Description

GitPython from 3.1.62 before 3.2.0 contains a symlink-following flaw in Submodule.move(), which checks the destination only lexically and does not reject symbolic links in intermediate path components. An untrusted repository can commit a symlink such as vendor pointing outside the worktree, so an application moving an initialized submodule beneath it relocates the checkout externally and corrupts the index and .gitmodules.

🔗 References (4)

https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-gq48-pqfc-9p58
https://nvd.nist.gov/vuln/detail/CVE-2026-110860
https://www.vulncheck.com/advisories/gitpython-3.1.62-before-3.2.0-symlink-path-traversal-via-submodule-move
https://github.com/advisories/GHSA-cfp4-478m-4f52