CVE-2026-82253
Received Received - Intake

Path Traversal in gitoxide Rust Crates

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: VulnCheck

Description
gitoxide (Rust crates gix <= 0.72.0 and gix-validate <= 0.10.0) contains a path traversal vulnerability. The submodule name validation function in gix-validate only checks the first occurrence of '..' via name.find(b".."), allowing crafted names such as 'a..b/../../../.git/' to bypass the check; additionally this validation is never invoked in production code paths. Combined with a trust inheritance flaw in Submodule::open(), where the parent repository's git_dir_trust (Trust::Full) is cloned and the ownership verification is skipped, an attacker can craft a malicious .gitmodules file so that a victim tool built on gitoxide reads arbitrary git repository configuration (including embedded credentials) with full trust, bypassing safe-directory protections. Fixed in gix 0.82.0 and gix-validate 0.11.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-28
Last Modified
2026-08-28
Generated
2026-08-28
AI Q&A
2026-08-28
EPSS Evaluated
N/A
NVD
CVE-2026-82253
EUVD
EUVD-2026-67705

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a path traversal vulnerability in gitoxide Rust crates (gix <= 0.72.0 and gix-validate <= 0.10.0). The issue involves improper validation of submodule names, where only the first occurrence of '..' is checked. This allows attackers to craft malicious names like 'a..b/../../../.git/' to bypass checks. Additionally, the validation function is not used in production code paths. Combined with a trust inheritance flaw in Submodule::open(), this enables reading arbitrary git repository configuration with full trust, bypassing safe-directory protections.

Detection Guidance

This vulnerability is specific to applications using vulnerable versions of the gitoxide Rust crates (gix <= 0.72.0 or gix-validate <= 0.10.0). Detection requires checking the version of these crates in your Rust projects or applications. Use commands like 'cargo tree' or 'cargo list' to inspect dependencies for gix or gix-validate versions.

Impact Analysis

An attacker could exploit this to read sensitive git repository configuration, including embedded credentials, from arbitrary locations. This could lead to unauthorized access to repositories, data leaks, or further attacks leveraging stolen credentials. Systems using vulnerable versions of gix or gix-validate are at risk.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR (data protection) and HIPAA (health information privacy) requirements. Exposure of credentials or repository data may result in non-compliance with data security and privacy controls mandated by these regulations.

Mitigation Strategies

Update to fixed versions of the affected crates: gix >= 0.82.0 and gix-validate >= 0.11.1. Remove or replace any applications using vulnerable versions. Review .gitmodules files for suspicious paths or submodule names containing '..' sequences. Ensure safe-directory protections are enforced in Git configurations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82253. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart