new file mode 100644
@@ -0,0 +1,90 @@
+From 1ed0ebc2f2e74d979cdc367a4864a7731fdcc093 Mon Sep 17 00:00:00 2001
+From: Byron <sebastian.thiel@icloud.com>
+Date: Tue, 1 Sep 2026 11:33:19 +0200
+Subject: [PATCH] Reject submodule checkout paths outside the repository
+
+GHSA-59cr-6r3x-644w identifies that submodule update paths could reach
+filesystem operations without the containment check already used by add and
+move.
+
+Add a regression that proves update rejects a parent-directory checkout
+path before cloning, and override Submodule.abspath to apply the shared
+_to_relative_path guard for every filesystem consumer.
+
+Git baseline: git.git read-cache.c verify_path_internal() rejects invalid index
+paths, covered for parent traversal by t/t9300-fast-import.sh.
+
+CVE: CVE-2026-100689
+Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/1ed0ebc2f2e74d979cdc367a4864a7731fdcc093]
+
+Backport Changes:
+- Strengthened the 3.1.43 _to_relative_path implementation to normalize
+ paths and verify commonpath containment; its prior prefix check did not
+ reject relative parent-directory traversal.
+- Omitted doc/source/changes.rst because it only records the release note.
+- Omitted test/test_submodule.py because the PyPI source archive does not
+ include the test suite.
+
+Assisted-by: GPT 5.6
+Co-authored-by: GPT 5.6 <codex@openai.com>
+(cherry picked from commit 1ed0ebc2f2e74d979cdc367a4864a7731fdcc093)
+Signed-off-by: Yogita Urade <yurade@cisco.com>
+---
+ git/objects/submodule/base.py | 46 +++++++++++++++++++++++++++++------------
+ 1 file changed, 33 insertions(+), 13 deletions(-)
+
+--- a/git/objects/submodule/base.py
++++ b/git/objects/submodule/base.py
+@@ -400,19 +400,39 @@
+ path = path[:-1]
+ # END handle trailing slash
+
+- if osp.isabs(path) and parent_repo.working_tree_dir:
+- working_tree_linux = to_native_path_linux(parent_repo.working_tree_dir)
+- if not path.startswith(working_tree_linux):
+- raise ValueError(
+- "Submodule checkout path '%s' needs to be within the parents repository at '%s'"
+- % (working_tree_linux, path)
+- )
+- path = path[len(working_tree_linux.rstrip("/")) + 1 :]
+- if not path:
+- raise ValueError("Absolute submodule path '%s' didn't yield a valid relative path" % path)
+- # END verify converted relative path makes sense
+- # END convert to a relative path
+-
++ root = parent_repo.working_tree_dir
++ if root:
++ drive, tail = osp.splitdrive(path)
++ separators = (os.sep,) if os.altsep is None else (os.sep, os.altsep)
++ if drive and not tail.startswith(separators):
++ raise ValueError("Drive-relative path %r is not supported" % path)
++
++ root_abs = osp.abspath(to_native_path_linux(root))
++ path_abs = osp.abspath(osp.join(root_abs, path))
++ try:
++ common_path = osp.commonpath([root_abs, path_abs])
++ except ValueError as e:
++ raise ValueError("Submodule checkout path %r is not in repository at %r" % (path, root_abs)) from e
++ if osp.normcase(common_path) != osp.normcase(root_abs):
++ raise ValueError("Submodule checkout path %r is not in repository at %r" % (path, root_abs))
++
++ path = to_native_path_linux(osp.relpath(path_abs, root_abs))
++
++ if not path or path == ".":
++ raise ValueError("Submodule checkout path must not be the repository root")
++
++ return path
++
++ @property
++ def abspath(self) -> PathLike:
++ root = self.repo.working_tree_dir
++ if root is None:
++ return super().abspath
++ path = root
++ for component in self._to_relative_path(self.repo, self.path).split("/"):
++ path = join_path_native(path, component)
++ if osp.islink(path):
++ raise ValueError("Submodule checkout path %r contains a symbolic link" % self.path)
+ return path
+
+ @classmethod
@@ -51,6 +51,7 @@ SRC_URI += "file://CVE-2026-42284.patch \
file://CVE-2026-87818.patch \
file://CVE-2026-87819_p1.patch \
file://CVE-2026-87819_p2.patch \
+ file://CVE-2026-100689.patch \
"
SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c"
This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/1ed0ebc2f2e74d979cdc367a4864a7731fdcc093 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-100689 Signed-off-by: Yogita Urade <yurade@cisco.com> --- .../python/python3-git/CVE-2026-100689.patch | 90 +++++++++++++++++++ .../python/python3-git_3.1.43.bb | 1 + 2 files changed, 91 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-100689.patch