CVE-2026-82251: gitoxidelabs gitoxide Path Traversal

Vulnerability summary

CVE-2026-82251 is a high (CVSS 8.7) Path Traversal vulnerability in gitoxidelabs gitoxide. EPSS estimates a 0.52% chance of exploitation in the next 30 days, higher than 43.1% of scored vulnerabilities.

Timeline

1. 28-08-2026
   PublishedVulnerability first disclosed.
2. 29-08-2026
   Last modifiedVulnerability information updated.

Description

gitoxide before 0.52.1 fails to validate submodule names from .gitmodules configuration, allowing path traversal when deriving submodule git directories. Attackers can craft malicious submodule names with traversal segments to redirect state() and open() functions to repositories outside .git/modules, causing repository confusion and inspection of attacker-controlled repositories.

• CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.