CVE-2026-82251: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitoxideLabs gitoxide

gitoxide versions prior to 0.52.1 do not properly validate submodule names specified in the .gitmodules configuration file. This improper limitation of pathname allows path traversal attacks when deriving submodule git directories. Specifically, attackers can include traversal segments in submodule names to redirect the state() and open() functions to repositories outside the expected .git/modules directory. This results in repository confusion and potential exposure to attacker-controlled repositories.

An attacker can exploit this vulnerability to cause the gitoxide client to access repositories outside the intended directory structure. This can lead to repository confusion and potentially allow inspection or interaction with attacker-controlled repositories. The vulnerability has a high severity score (CVSS 8.7) indicating significant impact if exploited, but there are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 0.52.1, upgrading to version 0.52.1 or later is likely the intended remediation once officially released. Until then, users should monitor vendor communications for patches or official fixes.