High [CVE-2026-76222] Arbitrary file creation via path traversal in.gitmodules submodule names

GitPython before 3.1.58 fails to validate submodule names from.gitmodules files, allowing attackers to create Git repositories at arbitrary filesystem paths outside the intended clone directory.

Attackers can craft malicious repositories with traversal sequences in submodule names that GitPython processes during submodule initialization, creating attacker-controlled Git repositories at escaped filesystem locations. A remote attacker could craft a malicious Git repository containing specially formed submodule names with directory traversal sequences.

CVE-2026-76222 is a path-traversal flaw in GitPython submodule handling: cloning a malicious repository and initializing its submodules can create files or repositories outside the intended directory, because GitPython omits the suspicious-submodule-name guard that upstream core git enforces.

Unlike the caller-gated GitPython option-forwarding flaws, this triggers during ordinary clone plus submodule initialization of an untrusted repository, so any Red Hat product that ships or bundles a vulnerable GitPython version is affected. Fixed in GitPython 3.1.58.

Red Hat severity: Important — CVSS 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:L). Weakness: CWE-22.