Read the docs
TI-2026-56716 Aliases CVE-2026-82251GHSA-66gr-hvvc-vvxc

gitoxide before 0.52.1 Path Traversal via Submodule Name

Priority HIGH 77CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

gitoxide before 0.52.1 fails to validate submodule names from .gitmodules configuration, allowing path traversal when deriving submodule git directories. Attackers can craft malicious submodule names with traversal segments to redirect state() and open() functions to repositories outside .git/modules, causing repository confusion and inspection of attacker-controlled repositories.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00522 44th percentileScored 2026-11-07
Fix Fixed gitoxide (GitoxideLabs): 0.52.1, 0.82.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GitoxideLabsgitoxidebefore 0.52.10.52.1Patch availableCNA
GitoxideLabsgitoxidebefore 0.82.00.82.0Patch availableCNA
  • gitoxide VendorGitoxideLabs Affected before 0.52.1 Fixed in 0.52.1 Patch available CNA
  • gitoxide VendorGitoxideLabs Affected before 0.82.0 Fixed in 0.82.0 Patch available CNA

Remediation

  • Fix · CNA gitoxide (GitoxideLabs) Fixed in 0.52.1
  • Fix · CNA gitoxide (GitoxideLabs) Fixed in 0.82.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    GitoxideLabs gitoxide 0.82.0

    3 records Highest priority Priority HIGH 3 HIGH

    Other records, highest priority first

    • TI-2026-56718 gitoxide before 0.82.0 Path Traversal via Submodule Name Validation BypassPriority HIGH 77
    • TI-2026-56717 gitoxide before 0.52.1 Repository Boundary Violation via symlinked .gitmodulesPriority HIGH 77
    Show all 3 records →
  • Release ·

    GitoxideLabs gitoxide 0.52.1

    2 records Highest priority Priority HIGH 2 HIGH

    Other records, highest priority first

    • TI-2026-56717 gitoxide before 0.52.1 Repository Boundary Violation via symlinked .gitmodulesPriority HIGH 77
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-82251
  2. 2026-10-03 Alias added: GHSA-66gr-hvvc-vvxc

References

Advisory 1

  • TI-2026-56719 gitoxide before 0.69.0 Denial of Service via gix-pack CVSS 4.0HIGH 8.7
  • TI-2026-56718 gitoxide before 0.82.0 Path Traversal via Submodule Name Validation Bypass CVSS 4.0HIGH 8.7
  • TI-2026-56717 gitoxide before 0.52.1 Repository Boundary Violation via symlinked .gitmodules CVSS 4.0HIGH 8.7
  • TI-2026-56712 gitoxide before 0.37.1 HTTP Basic credential leak via URL parsing CVSS 4.0HIGH 8.7
  • TI-2026-32410 gitoxide: Symlink prefix-reuse allows worktree escape during checkout CVSS 3.1HIGH 7.8
  • TI-2026-64668 gitoxide gix-fs before 0.23.0 Worktree Escape via Symlink CVSS 4.0HIGH 7.3
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences