# CVE-2026-82251: gitoxide path traversal in submodule name resolution

Source: https://junglewise.ai/threats/cve-2026-82251-gitoxide-path-traversal-in-submodule-name-resolution  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-28. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-82251 · Severity: high · CVSS 7.5 · Published 2026-08-28

gitoxide is a Rust library that parses and manages Git repositories, including submodule configurations. This vulnerability allows attackers to craft malicious submodule names containing traversal sequences (like "../../../") that escape the intended .git/modules directory and redirect operations to arbitrary repositories outside the project. An attacker can trick the library into checking the existence of or opening a repository at an attacker-controlled path, potentially enabling inspection of sensitive repository data or repository confusion attacks.

Technologies: [gitoxide (crates.io)](https://junglewise.ai/threats/technologies/crates-io-gitoxide), [gix (crates.io)](https://junglewise.ai/threats/technologies/gix), [GitoxideLabs Gitoxide](https://junglewise.ai/threats/technologies/gitoxide). Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io), [GitoxideLabs](https://junglewise.ai/threats/vendors/gitoxidelabs).

## Quick answers

**Is CVE-2026-82251 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82251 being exploited in the wild.

**How severe is CVE-2026-82251?** High severity, with a CVSS score of 7.5, published 28 August 2026.

**Which products and versions are affected?** gitoxide (crates.io) SEMVER:introduced=0,fixed=0.52.1; gix (crates.io) SEMVER:introduced=0,fixed=0.83.0; GitoxideLabs Gitoxide before 0.52.1 (all versions >= 0) and before 0.82 (all versions >= 0).

**Is there a fix for CVE-2026-82251?** Yes. gitoxide (crates.io): upgrade to 0.52.1 or later; gix (crates.io): upgrade to 0.83.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-82251 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-82251?** Check whether you run gitoxide (crates.io), gix (crates.io) or GitoxideLabs Gitoxide at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- gitoxide (crates.io): upgrade to 0.52.1 or later

  ```sh
  cargo update -p gitoxide
  ```

- gix (crates.io): upgrade to 0.83.0 or later

  ```sh
  cargo update -p gix
  ```


## Technical details

The vulnerability is a path-traversal issue (CWE-22) in how gitoxide derives submodule git directories from unvalidated submodule names in .gitmodules configuration. The code constructs the submodule path as common_dir/modules/<submodule_name> without validating or sanitizing the name, allowing traversal segments like "../" to escape the modules root. When state() or open() functions are called, they operate on the attacker-controlled path instead of the intended location within .git/modules. The attack requires a malicious .gitmodules file in a repository (typically delivered via git clone), but no authentication or user interaction beyond cloning. Patches are available in gitoxide 0.52.1 and 0.82.

## Affected products

- GitoxideLabs gitoxide before 0.52.1 (all versions >= 0) and before 0.82 (all versions >= 0)

## Identifiers

- CVE-2026-82251
- GHSA-fr8x-3vfx-f45h

## Timeline

- 2026-04-25: disclosed: GitHub Security Advisory GHSA-fr8x-3vfx-f45h published
- 2026-08-28: advisory: CVE-2026-82251 assigned and published on NVD
- 2026: patched: Fixed in gitoxide 0.52.1 and 0.82

## References

- [https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-fr8x-3vfx-f45h](https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-fr8x-3vfx-f45h)
- [https://www.vulncheck.com/advisories/gitoxide-before-0.52.1-path-traversal-via-submodule-name](https://www.vulncheck.com/advisories/gitoxide-before-0.52.1-path-traversal-via-submodule-name)

## Related threats

- [gitoxide commit-graph parser denial of service](https://junglewise.ai/threats/cve-2026-123533-gix-commitgraph-before-0-42-0-as-used-in-gitoxide-before-0-61-0)
- [gitoxide gix-fs NTLM credential disclosure via Windows symlink UNC probe](https://junglewise.ai/threats/cve-2026-123532-gix-fs-in-gitoxide-before-0-24-1-contains-a-credential)
- [gitoxide gix path-protection bypass via untrusted .git/config](https://junglewise.ai/threats/gitoxide-gix-untrusted-git-config-disables-filesystem-git-protection-1eddd4d0)
- [gitoxide path traversal in submodule name validation](https://junglewise.ai/threats/cve-2026-82253-gitoxide-path-traversal-in-submodule-name-validation)
- [gitoxide symlink following in .gitmodules file](https://junglewise.ai/threats/cve-2026-82252-gitoxide-symlink-following-in-gitmodules-file)