CVE-2026-82251
gitoxide before 0.52.1 Path Traversal via Submodule Name
- State
- Published
- Severity
- 8.7 High
- Published
- Aug 28, 2026
- Updated
- Aug 29, 2026
- Reserved
- Aug 28, 2026
Description
gitoxide before 0.52.1 fails to validate submodule names from .gitmodules configuration, allowing path traversal when deriving submodule git directories. Attackers can craft malicious submodule names with traversal segments to redirect state() and open() functions to repositories outside .git/modules, causing repository confusion and inspection of attacker-controlled repositories.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | VulnCheck |
Weaknesses
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected Products
| Product | Versions |
|---|---|
gitoxideGitoxideLabs |
|
gitoxideGitoxideLabs |
|
References
- GitHub Security Advisory (GHSA-fr8x-3vfx-f45h)vendor-advisory
- VulnCheck Advisory: gitoxide before 0.52.1 Path Traversal via Submodule Namethird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.