THREAT OPS › Threat News › [NVD] CVE-2026-82251 (HIGH 7.5) — gitoxide before 0.52.1 fails to validate submodule names from .gitmodules configuration, allowing path traversal when deriving submodule git directories. Attackers can craft malicious submodule names with traversal segments to redirect state() and open() functions to repositories
[NVD] CVE-2026-82251 (HIGH 7.5) — gitoxide before 0.52.1 fails to validate submodule names from .gitmodules configuration, allowing path traversal when deriving submodule git directories. Attackers can craft malicious submodule names with traversal segments to redirect state() and open() functions to repositories
CVE-2026-82251 CVSS: 7.5 HIGH Published: 2026-08-28T12:16:37.113
gitoxide before 0.52.1 fails to validate submodule names from .gitmodules configuration, allowing path traversal when deriving submodule git directories. Attackers can craft malicious submodule names with traversal segments to redirect state() and open() functions to repositories outside .git/modules, causing repository confusion an
Indicators of compromise
- CVE-2026-82251cve
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-82251