Path Traversal Vulnerability in Gitoxide by Gitoxide Labs
CVE-2026-82253

8.7HIGH

Key Information:

Vendor

Gitoxidelabs

Status
Gitoxide
Vendor
CVE Published:
28 August 2026

What is CVE-2026-82253?

The gitoxide project, specifically the Rust crates gix (up to version 0.72.0) and gix-validate (up to version 0.10.0), presents a path traversal vulnerability. This issue arises from an inadequate validation process in the submodule name validation function, which only examines the first occurrence of '..', allowing attackers to craft malicious submodule names, such as 'a..b/../../../.git/'. This vulnerability is compounded by a flaw in the Trust inheritance mechanism within the Submodule::open() function, which neglects proper ownership verification by cloning the parent repository's git_dir_trust setting. Consequently, attackers can manipulate a .gitmodules file to make tools built on gitoxide read arbitrary git repository configurations, potentially exposing embedded credentials while bypassing safe-directory protections. Users are advised to update to gix version 0.82.0 and gix-validate version 0.11.1 to mitigate this risk.

Affected Version(s)

gitoxide 0 < 0.82.0

gitoxide 0 < 0.11.1

gitoxide 0.82.0

References

https://github.com/GitoxideLabs/gitoxide/security/advisor...
vendor-advisory
https://www.vulncheck.com/advisories/gitoxide-before-0.82...
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

kodareef5
.