High severity · published Aug 28, 2026
CVE-2026-82251
gitoxide before 0.52.1 Path Traversal via Submodule Name
7.5
CVSS
0.5%
EPSS
No
On KEV
Description
gitoxide before 0.52.1 fails to validate submodule names from .gitmodules configuration, allowing path traversal when deriving submodule git directories. Attackers can craft malicious submodule names with traversal segments to redirect state() and open() functions to repositories outside .git/modules, causing repository confusion and inspection of attacker-controlled repositories.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GI
gitoxide · GitoxideLabs
before 0.52.1; before 0.82.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-82251
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-82251
github.com
https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-fr8x-3vfx-f45h
www.vulncheck.com
https://www.vulncheck.com/advisories/gitoxide-before-0.52.1-path-traversal-via-submodule-name
More from gitoxide
7.8
CVE-2026-44471
gitoxide: Symlink prefix-reuse allows worktree escape during checkout
7.5
CVE-2026-82254
gitoxide before 0.69.0 Denial of Service via gix-pack
7.5
CVE-2026-82253
gitoxide before 0.82.0 Path Traversal via Submodule Name Validation Bypass
7.5
CVE-2026-82252
gitoxide before 0.52.1 Repository Boundary Violation via symlinked .gitmodules
7.5
CVE-2026-82247
gitoxide before 0.37.1 HTTP Basic credential leak via URL parsing