---
cve: "CVE-2026-82251"
severity: "HIGH"
cvss: 8.7
epss: "0.4%"
vendor: "GitoxideLabs"
kev: false
exploited: false
published: "2026-08-28 12:16:37"
tags: [cve, security, high]
source: tsecurity.de CVE-Dossier
exported: "2026-09-27T23:35:06+02:00"
---

# CVE-2026-82251

> 8.7 HIGH · 🧪 PoC

## Beschreibung

gitoxide before 0.52.1 fails to validate submodule names from .gitmodules configuration, allowing path traversal when deriving submodule git directories. Attackers can craft malicious submodule names with traversal segments to redirect state() and open() functions to repositories outside .git/modules, causing repository confusion and inspection of attacker-controlled repositories.

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **poc**
  - Automatable: **yes**
  - Technical Impact: **partial**

## CVSS-Vektor

```
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |

## Patch verfügbar (OSV)

- a4bab3cc3275a8d645a906915ae59ede926e13b1 (Commit)
- 0a844e79db76c72b39c05e4705f0f7b40d1af9ab (Commit)

## Referenzen

- <https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-fr8x-3vfx-f45h>
- <https://www.vulncheck.com/advisories/gitoxide-before-0.52.1-path-traversal-via-submodule-name>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-82251) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_