GHSA-fr8x-3vfx-f45h
NoneCVSS
—
EPSS
—
Published
May 5, 2026
CISA due date
—
The record
gix and gitoxide: unvalidated submodule name traverses out of .git/modules and redirects state() / open() to another repository
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| crates.io | gitoxide | 0 | 0.52.1 |
| crates.io | gix | 0 | 0.83.0 |
Related vulnerabilities
- GHSA-pg4w-g64p-qwhj gix and gitoxide's symlinked .gitmodules are followed and parsed from outside of the… Also affects gitoxide
- CVE-2024-35186 gitoxide is a pure Rust implementation of Git. Also affects gitoxide
- GHSA-f26g-jm89-4g65 gitoxide: CommandForbiddenInModulesConfiguration Bypass in gix_submodule::File::update()… Also affects gix
- GHSA-p3hw-mv63-rf9w gix's submodule name validation bypass + trust inheritance flaw enables path traversal… Also affects gix
- CVE-2026-81163 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')… CWE-22
- CVE-2026-112049 Vita3K before build 4187 contains a path traversal (zip slip) vulnerability in… CWE-22
- CVE-2026-112005 WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote… CWE-22
- CVE-2026-61702 OpenPrinting CUPS is an open source printing system for Linux and other Unix-like… CWE-22