CVE-2026-82253: gitoxide path traversal in submodule name validation

CVE-2026-82253 · Severity: high · CVSS 7.5 · Published 2026-08-28

gitoxide is a Rust library that reads and manages Git repositories. A vulnerability allows attackers to craft malicious repository files that cause gitoxide to read configuration files from arbitrary locations on disk with full trust, potentially exposing embedded credentials. The flaw combines incomplete path traversal checks with flawed trust inheritance when opening submodules.

Technologies: gix (crates.io). Vendors: crates.io, GitoxideLabs.

Quick answers

Is CVE-2026-82253 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-82253 being exploited in the wild.
How severe is CVE-2026-82253?
High severity, with a CVSS score of 7.5, published 28 August 2026.
Which products and versions are affected?
gix (crates.io) SEMVER:introduced=0,fixed=0.83.0; gix-validate (crates.io) SEMVER:introduced=0,fixed=0.11.1; GitoxideLabs Gix-Validate <= 0.10.0.
Is there a fix for CVE-2026-82253?
Yes. gix (crates.io): upgrade to 0.83.0 or later; gix-validate (crates.io): upgrade to 0.11.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-82253 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-82253?
Check whether you run gix (crates.io), gix-validate (crates.io) or GitoxideLabs Gix-Validate at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • gix (crates.io): upgrade to 0.83.0 or later
    cargo update -p gix
  • gix-validate (crates.io): upgrade to 0.11.1 or later
    cargo update -p gix-validate

Technical details

The vulnerability involves three interconnected issues: (1) the submodule name validation function only checks the first occurrence of ".." using find(), allowing bypasses like "a..b/../../../.git/" to pass; (2) this validation is never called in production code paths that construct filesystem paths from submodule names; and (3) Submodule::open() inherits the parent repository's git_dir_trust setting (Trust::Full) without re-verifying ownership, causing traversed paths to be opened with full trust. An attacker can craft a .gitmodules file with a crafted submodule name that path-traverses to sibling git directories, which are then parsed with full trust, exposing credentials and other sensitive configuration. The attack requires user interaction (submodule operations) but no authentication.

Affected products

  • GitoxideLabs gix <= 0.72.0
  • GitoxideLabs gix-validate <= 0.10.0

Identifiers

  • CVE-2026-82253
  • GHSA-p3hw-mv63-rf9w

Timeline

  • 2026-04-25: disclosed: GitHub Security Advisory GHSA-p3hw-mv63-rf9w published
  • 2026-08-28: advisory: CVE-2026-82253 published on NVD
  • 2026-04-25: patched: gix 0.82.0 and gix-validate 0.11.1 released with fixes

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.