gitoxide before 0.82.0 Path Traversal via Submodule Name Validation Bypass

CISA KEV lists vulnerabilities known to be exploited. FIRST EPSS estimates the likelihood of exploitation in the next 30 days. An unavailable score does not mean zero risk.

No exploitation or prediction data is available here for these CVEs. This does not mean they are safe or unlikely to be exploited.

gitoxide (Rust crates gix <= 0.72.0 and gix-validate <= 0.10.0) contains a path traversal vulnerability. The submodule name validation function in gix-validate only checks the first occurrence of '..' via name.find(b".."), allowing crafted names such as 'a..b/../../../.git/' to bypass the check; additionally this validation is never invoked in production code paths. Combined with a trust inheritance flaw in Submodule::open(), where the parent repository's git_dir_trust (Trust::Full) is cloned and the ownership verification is skipped, an attacker can craft a malicious .gitmodules file so that a victim tool built on gitoxide reads arbitrary git repository configuration (including embedded credentials) with full trust, bypassing safe-directory protections. Fixed in gix 0.82.0 and gix-validate 0.11.1.

Source published

28 Aug 2026 10:49:37 UTC

Source modified

31 Aug 2026 18:34:55 UTC

Saved here

23 Oct 2026 15:48:27 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

Source: cve-program · CVE Program Terms of Use. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

CVSS 4.0 · 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

CVSS 3.1 · 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

gitoxide (Rust crates gix <= 0.72.0 and gix-validate <= 0.10.0) contains a path traversal vulnerability. The submodule name validation function in gix-validate only checks the first occurrence of '..' via name.find(b".."), allowing crafted names such as 'a..b/../../../.git/' to bypass the check; additionally this validation is never invoked in production code paths. Combined with a trust inheritance flaw in Submodule::open(), where the parent repository's git_dir_trust (Trust::Full) is cloned and the ownership verification is skipped, an attacker can craft a malicious .gitmodules file so that a victim tool built on gitoxide reads arbitrary git repository configuration (including embedded credentials) with full trust, bypassing safe-directory protections. Fixed in gix 0.82.0 and gix-validate 0.11.1.

Source published

Aug 28, 2026, 10:49:37 AM (timezone not stated)

Source modified

Aug 31, 2026, 6:34:55 PM (timezone not stated)

Saved here

13 Nov 2026 17:09:20 UTC

Source terms

ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

Source: euvd · ENISA EUVD · source terms and attribution apply. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

EUVD CVSS 4.0 · 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

gitoxide (Rust crates gix <= 0.72.0 and gix-validate <= 0.10.0) contains a path traversal vulnerability. The submodule name validation function in gix-validate only checks the first occurrence of '..' via name.find(b".."), allowing crafted names such as 'a..b/../../../.git/' to bypass the check; additionally this validation is never invoked in production code paths. Combined with a trust inheritance flaw in Submodule::open(), where the parent repository's git_dir_trust (Trust::Full) is cloned and the ownership verification is skipped, an attacker can craft a malicious .gitmodules file so that a victim tool built on gitoxide reads arbitrary git repository configuration (including embedded credentials) with full trust, bypassing safe-directory protections. Fixed in gix 0.82.0 and gix-validate 0.11.1.

Source published

28 Aug 2026 12:16:38 UTC

Source modified

31 Aug 2026 19:17:16 UTC

Saved here

25 Oct 2026 16:19:10 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

Source: nvd · NIST NVD usage terms; underlying source attribution retained. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

CVSS 4.0 · [email protected] · Secondary · 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS 3.1 · [email protected] · Secondary · 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

### Summary Submodule name validation bypass plus missing validation in production code paths allows path traversal via crafted `.gitmodules`. Combined with a trust inheritance flaw in `Submodule::open()`, this enables reading arbitrary git repository configs (including credentials) from traversed paths with full trust (CWE-22, CWE-200). ### Details **Bug 1: Validation bypass in `gix-validate/src/submodule.rs` (lines 27-42)** The `name()` function uses `name.find(b"..")` which returns only the FIRST occurrence. If the first `..` is embedded in a non-traversal context, the function returns `Ok` without checking subsequent `../` sequences: ```rust pub fn name(name: &BStr) -> Result<&BStr, name::Error> { match name.find(b"..") { Some(pos) => { let &b = name.get(pos + 2).ok_or(name::Error::ParentComponent)?; if b == b'/' || b == b'\\' { Err(name::Error::ParentComponent) } else { Ok(name) // Returns Ok without checking rest of string } } None => Ok(name), } } ``` Bypass: `a..b/../../../.git/` passes because `find(b"..")` returns position 1 (the `..` in `a..b`), checks `name[3] == b'b'`, and returns Ok. The real `/../../../` is never checked. **Bug 2: Validation never called in production** `gix_validate::submodule::name()` has zero production callers (only test code). The `names()` iterator in `gix-submodule/src/access.rs:29` explicitly documents it returns "unvalidated names." `git_dir()` at `gix/src/submodule/mod.rs:198-204` constructs filesystem paths from raw names: ```rust pub fn git_dir(&self) -> PathBuf { self.state.repo.common_dir().join("modules").join(gix_path::from_bstr(self.name())) } ``` **Bug 3: Trust inheritance bypass in `Submodule::open()`** At `gix/src/submodule/mod.rs:270`, `open()` clones the parent repository's options: ```rust match crate::open_opts(self.git_dir_try_old_form()?, self.state.repo.options.clone()) { ``` The parent's `options.git_dir_trust` is `Some(Trust::Full)`. At `gix/src/open/repository.rs:103-104`: ```rust if options.git_dir_trust.is_none() { options.git_dir_trust = gix_sec::Trust::from_path_ownership(&git_dir)?.into(); } ``` Since trust is already `Some(Full)`, the ownership check is **skipped entirely**. The traversed path is opened with `Trust::Full` regardless of ownership, bypassing gitoxide's safe-directory protections. ### PoC Compiled and executed in Rust 1.94.1 `--release` mode. All bypass cases confirmed: ``` BYPASS a..b/../../../.git/ -> PASSED validation git_dir = .git/modules/a..b/../../../.git/ normalized = .git/ (parent repo!) BYPASS x..y/../../../.git/config -> PASSED validation git_dir = .git/modules/x..y/../../../.git/config normalized = .git/config ``` ### Attack chain 1. Attacker crafts a repository with `.gitmodules`: ```ini [submodule "x..y/../../.."] path = innocent url = https://attacker.com/repo.git ``` 2. Victim clones the repository using a tool built on gitoxide. 3. When the tool iterates submodules and calls `submodule.open()` or `submodule.status()`: - `git_dir()` returns `.git/modules/x..y/../../..` which resolves to the parent `.git/` - `open_opts()` is called with `Trust::Full` (inherited from parent, ownership check skipped) - The parent's `.git/config` is fully parsed 4. The returned `Repository` object exposes all config values from the traversed path: - `remote.origin.url` (may contain `https://user:[email protected]/...`) - `http.extraHeader` (often `Authorization: Bearer <token>`) - `credential.*` sections - `core.sshCommand` 5. Accessible via standard API: `repo.config_snapshot().string("http.extraHeader")`, `repo.find_remote("origin")`, etc. ### Impact A crafted `.gitmodules` in a malicious repository causes gitoxide to open arbitrary git directories as submodule repositories with full trust, exposing their configuration including credentials. This is the same class of vulnerability as GHSA-7w47-3wg8-547c (path traversal), but through the submodule name vector with an additional trust bypass. The trust inheritance is the critical amplifier: without it, the traversed path would undergo ownership checks that could block the attack. With it, any git directory reachable via `../` is opened with full trust. ### Honest limitations - The traversed path must be a valid git directory (HEAD, objects/, refs/ must exist) - The victim's tool must call `open()` or `status()` on submodules (tools that only list submodules are not affected) - Credential exposure requires the target config to contain embedded credentials - Submodule operations currently require explicit user action ### Suggested fix 1. Fix the validation to check ALL `..` occurrences (iterate, not single `find`) 2. Call `gix_validate::submodule::name()` in `git_dir()` before constructing the path 3. Do NOT inherit `git_dir_trust` from parent when opening submodule repos -- always re-derive trust from path ownership ### Severity High. Network vector (via clone), requires user interaction (submodule operations). The trust bypass enables credential disclosure from traversed git directories. Confidentiality impact is high.

Source published

5 May 2026 19:20:38 UTC

Source modified

10 Sep 2026 03:50:47 UTC

Saved here

24 Oct 2026 13:19:54 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

Source: osv · GitHub Advisory Database · CC-BY-4.0. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

CVSS_V4 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Publisher rating · HIGH