gitoxide before 0.52.1 Path Traversal via Submodule Name
Historical advisory recorded 23 Oct 2026 15:48:27 UTC. Read the latest advisory.
cve-program · CVE-2026-82251
Publishedgitoxide before 0.52.1 fails to validate submodule names from .gitmodules configuration, allowing path traversal when deriving submodule git directories. Attackers can craft malicious submodule names with traversal segments to redirect state() and open() functions to repositories outside .git/modules, causing repository confusion and inspection of attacker-controlled repositories.
Read the publisher's advisoryAffected versions, risk and source history
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-82251 · CVE overview and exploitation status
cve-program · CVE-2026-82251
This historical advisory does not include today's related changes. Open the latest advisory to find current connections.