gitoxide before 0.52.1 Path Traversal via Submodule Name
cve-program · CVE-2026-82251
Publishedgitoxide before 0.52.1 fails to validate submodule names from .gitmodules configuration, allowing path traversal when deriving submodule git directories. Attackers can craft malicious submodule names with traversal segments to redirect state() and open() functions to repositories outside .git/modules, causing repository confusion and inspection of attacker-controlled repositories.
Read the publisher's advisoryeuvd · EUVD-2026-67703
Publishedgitoxide before 0.52.1 fails to validate submodule names from .gitmodules configuration, allowing path traversal when deriving submodule git directories. Attackers can craft malicious submodule names with traversal segments to redirect state() and open() functions to repositories outside .git/modules, causing repository confusion and inspection of attacker-controlled repositories.
Read the publisher's advisorynvd · CVE-2026-82251
Publishedgitoxide before 0.52.1 fails to validate submodule names from .gitmodules configuration, allowing path traversal when deriving submodule git directories. Attackers can craft malicious submodule names with traversal segments to redirect state() and open() functions to repositories outside .git/modules, causing repository confusion and inspection of attacker-controlled repositories.
Read the publisher's advisoryosv · GHSA-fr8x-3vfx-f45h
Published## **Summary** attachments: [pocs.zip](https://github.com/user-attachments/files/26431422/pocs.zip) Submodule names coming from `.gitmodules` are exposed as unvalidated names and are later reused to derive the submodule git directory as: ``` <superproject common_dir>/modules/<submodule name> ``` Because the submodule name is joined directly as a filesystem path component, a name such as `../../../escaped-target.git` escapes `.git/modules` after normalization. The current implementation then uses that escaped path in both `state()` and `open()`. The updated PoC demonstrates the real sink, not just string construction: - `state()` reports `repository_exists=true` for the traversed path; - `open()` returns a repository whose normalized `common_dir()` matches the attacker-chosen repository outside `.git/modules`. ## **Root cause analysis** The relevant flow is: 1. [`gix-submodule/src/access.rs`](https://github.com/GitoxideLabs/gitoxide/blob/v0.52.0/gix-submodule/src/access.rs) exposes unvalidated submodule names from configuration. 2. [`gix/src/submodule/mod.rs`](https://github.com/GitoxideLabs/gitoxide/blob/v0.52.0/gix/src/submodule/mod.rs) derives the git directory by doing `common_dir().join("modules").join(name)` with no confinement check. 3. [`gix/src/submodule/mod.rs`](https://github.com/GitoxideLabs/gitoxide/blob/v0.52.0/gix/src/submodule/mod.rs) uses that derived path during state resolution and repository opening. There is no normalization-and-confinement step between “submodule name from configuration” and “filesystem path used for repository existence checks / open.” As a result, traversal segments in the submodule name directly influence which repository path is inspected and opened. ## **Reproduce steps** Use the attached PoC zip that contains the `pocs/` workspace. 1. Unzip the PoC archive. 2. Enter `pocs/F002`. 3. Run: ``` cargo run --quiet ``` 4. Compare the output with `pocs/F002/result.txt`. Key outputs are: - `submodule_name=../../../escaped-target.git` - `derived_git_dir_raw=.../.git/modules/../../../escaped-target.git` - `derived_git_dir_normalized=.../artifacts/escaped-target.git` - `escaped_target=.../artifacts/escaped-target.git` - `repository_exists=true` - `submodule_opened=true` - `opened_common_dir_normalized=.../artifacts/escaped-target.git` - `normalized_git_dir_matches_target=true` - `opened_common_dir_matches_target=true` - `target_outside_modules_root=true` These outputs show that gitoxide is not only constructing a traversable path string. It is actually using the escaped path for repository existence checks and for opening a repository object. ## **Impact** Confirmed impact: - a malicious submodule name can redirect submodule state inspection away from `.git/modules/<name>` to an attacker-chosen repository path outside `.git/modules`; - `Submodule::state()` can report repository existence for the wrong repository; - `Submodule::open()` can return a repository object backed by that attacker-chosen path. This is best described as a path-traversal / repository-confusion issue in submodule repository resolution. This report does **not** claim command execution from this behavior alone. The demonstrated impact is repository redirection: callers that enumerate, inspect, or operate on submodules can be steered into using the wrong repository. ## **Recommended fix** Two complementary fixes are advisable: 1. do not reuse raw submodule names as filesystem path fragments; - either use a validated/sanitized name for filesystem derivation, - or derive the storage path from a safe identifier instead of the user-controlled name; 2. add an explicit confinement check after path derivation; - normalize or canonicalize the candidate path, - verify that the result stays under `<common_dir>/modules`, - reject names that contain traversal segments, path separators, or any representation that can escape the modules root. In short, submodule names may remain opaque configuration identifiers, but they should not be treated as trusted filesystem subpaths.
Read the publisher's advisoryAffected versions, risk and source history
Exploitation and risk
Source statusCISA KEV lists vulnerabilities known to be exploited. FIRST EPSS estimates the likelihood of exploitation in the next 30 days. An unavailable score does not mean zero risk.
Which CVEs have scores here?
This view includes predictions for CVE identifiers explicitly listed in public NuGet advisories. Microsoft release pages have their own prediction coverage. Check source status for the scope and latest checks.
No exploitation or prediction data is available here for these CVEs. This does not mean they are safe or unlikely to be exploited.
cve-program · CVE-2026-82251
Publishedgitoxide before 0.52.1 Path Traversal via Submodule Name
gitoxide before 0.52.1 fails to validate submodule names from .gitmodules configuration, allowing path traversal when deriving submodule git directories. Attackers can craft malicious submodule names with traversal segments to redirect state() and open() functions to repositories outside .git/modules, causing repository confusion and inspection of attacker-controlled repositories.
- Source published
- 28 Aug 2026 10:49:36 UTC
- Source modified
- 29 Aug 2026 13:38:27 UTC
- Saved here
- 23 Oct 2026 15:48:27 UTC
- Source terms
- CVE Program Terms of Use
Original source record · Cite this exact observation · Complete original publisher JSON
Source: cve-program · CVE Program Terms of Use. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.
CVSS 4.0 · 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1 · 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
euvd · EUVD-2026-67703
Publishedgitoxide before 0.52.1 fails to validate submodule names from .gitmodules configuration, allowing path traversal when deriving submodule git directories. Attackers can craft malicious submodule names with traversal segments to redirect stat…
gitoxide before 0.52.1 fails to validate submodule names from .gitmodules configuration, allowing path traversal when deriving submodule git directories. Attackers can craft malicious submodule names with traversal segments to redirect state() and open() functions to repositories outside .git/modules, causing repository confusion and inspection of attacker-controlled repositories.
Additional publisher context
EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.
Original publisher date fields
datePublished: Aug 28, 2026, 10:49:36 AM
dateUpdated: Aug 29, 2026, 1:38:27 PM
3 related source bulletins · separate from aliases
msrc_CVE-2026-82251: gitoxide before 0.52.1 Path Traversal via Submodule Name
CVE-2026-82251
openSUSE-SU-2026:11741-1: cargo-c-0.10.25-1.1 on GA media
CVE-2026-82247 · CVE-2026-82250 · CVE-2026-82251 · CVE-2026-82253 · CVE-2026-82254
openSUSE-SU-2026:11730-1: cargo-audit-0.22.2~git0.281452c-3.1 on GA media
CVE-2026-82247 · CVE-2026-82250 · CVE-2026-82251 · CVE-2026-82253 · CVE-2026-82254
- Source published
- Aug 28, 2026, 10:49:36 AM (timezone not stated)
- Source modified
- Aug 29, 2026, 1:38:27 PM (timezone not stated)
- Saved here
- 15 Nov 2026 17:53:04 UTC
- Source terms
- ENISA EUVD · source terms and attribution apply
Original source record · Cite this exact observation · Complete original publisher JSON
Source: euvd · ENISA EUVD · source terms and attribution apply. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.
EUVD CVSS 4.0 · 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
nvd · CVE-2026-82251
Publishedgitoxide before 0.52.1 fails to validate submodule names from .gitmodules configuration, allowing path traversal when deriving submodule git directories. Attackers can craft malicious submodule names with traversal segments to redirect stat…
gitoxide before 0.52.1 fails to validate submodule names from .gitmodules configuration, allowing path traversal when deriving submodule git directories. Attackers can craft malicious submodule names with traversal segments to redirect state() and open() functions to repositories outside .git/modules, causing repository confusion and inspection of attacker-controlled repositories.
Additional publisher context
NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.
Source analysis status: Deferred
Weakness classifications: CWE-22
Original publisher date fields
published: 2026-08-28T12:16:37.113
lastModified: 2026-08-29T14:16:37.677
- Source published
- 28 Aug 2026 12:16:37 UTC
- Source modified
- 29 Aug 2026 14:16:37 UTC
- Saved here
- 25 Oct 2026 16:19:10 UTC
- Source terms
- NIST NVD usage terms; underlying source attribution retained
Original source record · Cite this exact observation · Complete original publisher JSON
Source: nvd · NIST NVD usage terms; underlying source attribution retained. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.
CVSS 4.0 · [email protected] · Secondary · 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1 · [email protected] · Secondary · 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
osv · GHSA-fr8x-3vfx-f45h
Publishedgix and gitoxide: unvalidated submodule name traverses out of .git/modules and redirects state() / open() to another repository
## **Summary** attachments: [pocs.zip](https://github.com/user-attachments/files/26431422/pocs.zip) Submodule names coming from `.gitmodules` are exposed as unvalidated names and are later reused to derive the submodule git directory as: ``` <superproject common_dir>/modules/<submodule name> ``` Because the submodule name is joined directly as a filesystem path component, a name such as `../../../escaped-target.git` escapes `.git/modules` after normalization. The current implementation then uses that escaped path in both `state()` and `open()`. The updated PoC demonstrates the real sink, not just string construction: - `state()` reports `repository_exists=true` for the traversed path; - `open()` returns a repository whose normalized `common_dir()` matches the attacker-chosen repository outside `.git/modules`. ## **Root cause analysis** The relevant flow is: 1. [`gix-submodule/src/access.rs`](https://github.com/GitoxideLabs/gitoxide/blob/v0.52.0/gix-submodule/src/access.rs) exposes unvalidated submodule names from configuration. 2. [`gix/src/submodule/mod.rs`](https://github.com/GitoxideLabs/gitoxide/blob/v0.52.0/gix/src/submodule/mod.rs) derives the git directory by doing `common_dir().join("modules").join(name)` with no confinement check. 3. [`gix/src/submodule/mod.rs`](https://github.com/GitoxideLabs/gitoxide/blob/v0.52.0/gix/src/submodule/mod.rs) uses that derived path during state resolution and repository opening. There is no normalization-and-confinement step between “submodule name from configuration” and “filesystem path used for repository existence checks / open.” As a result, traversal segments in the submodule name directly influence which repository path is inspected and opened. ## **Reproduce steps** Use the attached PoC zip that contains the `pocs/` workspace. 1. Unzip the PoC archive. 2. Enter `pocs/F002`. 3. Run: ``` cargo run --quiet ``` 4. Compare the output with `pocs/F002/result.txt`. Key outputs are: - `submodule_name=../../../escaped-target.git` - `derived_git_dir_raw=.../.git/modules/../../../escaped-target.git` - `derived_git_dir_normalized=.../artifacts/escaped-target.git` - `escaped_target=.../artifacts/escaped-target.git` - `repository_exists=true` - `submodule_opened=true` - `opened_common_dir_normalized=.../artifacts/escaped-target.git` - `normalized_git_dir_matches_target=true` - `opened_common_dir_matches_target=true` - `target_outside_modules_root=true` These outputs show that gitoxide is not only constructing a traversable path string. It is actually using the escaped path for repository existence checks and for opening a repository object. ## **Impact** Confirmed impact: - a malicious submodule name can redirect submodule state inspection away from `.git/modules/<name>` to an attacker-chosen repository path outside `.git/modules`; - `Submodule::state()` can report repository existence for the wrong repository; - `Submodule::open()` can return a repository object backed by that attacker-chosen path. This is best described as a path-traversal / repository-confusion issue in submodule repository resolution. This report does **not** claim command execution from this behavior alone. The demonstrated impact is repository redirection: callers that enumerate, inspect, or operate on submodules can be steered into using the wrong repository. ## **Recommended fix** Two complementary fixes are advisable: 1. do not reuse raw submodule names as filesystem path fragments; - either use a validated/sanitized name for filesystem derivation, - or derive the storage path from a safe identifier instead of the user-controlled name; 2. add an explicit confinement check after path derivation; - normalize or canonicalize the candidate path, - verify that the result stays under `<common_dir>/modules`, - reject names that contain traversal segments, path separators, or any representation that can escape the modules root. In short, submodule names may remain opaque configuration identifiers, but they should not be treated as trusted filesystem subpaths.
- Source published
- 5 May 2026 19:27:51 UTC
- Source modified
- 10 Sep 2026 03:51:05 UTC
- Saved here
- 24 Oct 2026 13:19:54 UTC
- Source terms
- GitHub Advisory Database · CC-BY-4.0
Original source record · Cite this exact observation · Complete original publisher JSON
Source: osv · GitHub Advisory Database · CC-BY-4.0. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.
CVSS_V4 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Publisher rating · HIGH