Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2026-82251

gitoxide before 0.52.1 Path Traversal via Submodule Name

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

gitoxide before 0.52.1 fails to validate submodule names from .gitmodules configuration, allowing path traversal when deriving submodule git directories. Attackers can craft malicious submodule names with traversal segments to redirect state() and open() functions to repositories outside .git/modules, causing repository confusion and inspection of attacker-controlled repositories.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

GitoxideLabs gitoxide

Default version status: unaffected

  • 0 to < 0.52.1affected
  • 0.52.1unaffected
pkg:cargo/gitoxide

GitoxideLabs gitoxide

Default version status: unaffected

  • 0 to < 0.82.0affected
  • 0.82.0unaffected
pkg:cargo/gix

References