CVE-2026-82251 gitoxide before 0.52.1 Path Traversal via Submodule Name
Attackers can exploit path traversal in gitoxide submodule handling to access or confuse repositories outside the intended directory.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-82251?
CVE-2026-82251 is a high-severity path traversal vulnerability in GitoxideLabs gitoxide, published on 28 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
gitoxide before 0.52.1 fails to validate submodule names from .gitmodules configuration, allowing path traversal when deriving submodule git directories. Attackers can craft malicious submodule names with traversal segments to redirect state() and open() functions to repositories outside .git/modules, causing repository confusion and inspection of attacker-controlled repositories.
Weakness: CWE-22
Which versions are affected by CVE-2026-82251?
4 open source packages ship an affected version, including gitoxide and gix.
| Package | Affected | Fixed in |
|---|---|---|
gitoxide crates.io | All versions | 0.52.1 |
gitoxide crates.io | All versions | 0.52.1 |
gix crates.io | All versions | 0.83.0 |
gix crates.io | All versions | 0.83.0 |
How do I fix CVE-2026-82251?
Upgrade gitoxide to 0.52.1 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-82251 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-82251 exists.
Sources
Also known as AZL-98406, AZL-98421, DEBIAN-CVE-2026-82251, GHSA-66gr-hvvc-vvxc, GHSA-fr8x-3vfx-f45h, MINI-v3f4-jf7p-4fcc and 1 more.