A vulnerability in the gix library allows bypassing submodule name validation and exploits a trust inheritance flaw in submodule handling. This enables path traversal via crafted .gitmodules files, allowing an attacker to cause gitoxide-based tools to open arbitrary git repository directories with full trust. As a result, sensitive configuration data including credentials can be disclosed. The issue arises because validation only checks the first '..' sequence and is not enforced in production code, combined with the submodule open function inheriting full trust from the parent repository without ownership verification. Fixed versions 0.83.0 and 0.11.1 address these issues.