Description

gitoxide before 0.52.1 fails to validate submodule names from .gitmodules configuration, allowing path traversal when deriving submodule git directories. Attackers can craft malicious submodule names with traversal segments to redirect state() and open() functions to repositories outside .git/modules, causing repository confusion and inspection of attacker-controlled repositories.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-28T12:16:37.113Z",
  "pubdate": "2026-08-28T12:16:37.113Z",
  "executiveSummary": "A path traversal vulnerability exists in gitoxide versions prior to 0.52.1, stemming from improper validation of submodule names defined within .gitmodules configuration files.\nThe vulnerability allows an attacker to manipulate submodule names using directory traversal sequences to influence the path resolution logic used by the state() and open() functions.\nBy redirecting these functions, an attacker can force the application to interact with arbitrary repositories located outside the designated .git/modules directory.\nThis repository confusion attack enables unauthorized access and inspection of attacker-controlled repositories, potentially leading to information disclosure or the execution of malicious operations within the context of the affected gitoxide-based application.\nSuccessful exploitation requires the victim to process a maliciously crafted repository or configuration containing the manipulated submodule definitions.\nThe security risk is significant for developers and CI/CD systems relying on gitoxide for automated repository management, as it undermines the integrity of the cloned environment.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient sanitization of submodule identifier strings parsed from the .gitmodules file. When gitoxide processes these configurations, it derives the submodule's internal git directory path by appending the submodule name to a base directory path. Because the submodule name is not validated against traversal sequences (such as '../'), the path resolution mechanism can escape the intended boundary of the .git/modules directory.\nThe vulnerable functions, state() and open(), rely on these improperly derived paths to locate and initialize submodule metadata and repository data. Under normal operations, these functions are expected to operate strictly within the repository's internal metadata storage. By injecting traversal characters, an attacker can influence these functions to resolve paths to unauthorized locations on the host filesystem.\nThe attack flow proceeds as follows: First, an attacker crafts a git repository containing a .gitmodules file where the name of a submodule is set to a malicious string, such as '../../path/to/attacker/controlled/repo'. Second, the attacker causes a target system running a gitoxide-based application to clone or inspect this repository. Third, as the gitoxide library parses the malicious .gitmodules entry, the path derivation logic fails to neutralize the traversal segments. Fourth, the state() and open() functions interpret the resulting path as legitimate, redirecting their operations to the attacker-specified directory.\nThis vulnerability effectively achieves directory traversal in a critical repository-handling component, allowing the application to treat an external or arbitrary directory as a valid submodule repository. Post-exploitation impact includes repository confusion, where the library may attempt to execute operations against the redirected path, potentially exposing sensitive configuration data or allowing for the execution of code if the application logic assumes the integrity of the opened repository contents.\nThe vulnerability affects all gitoxide versions prior to 0.52.1. It requires no specific authentication or privilege escalation on the host system beyond the initial ability to provide a repository to the application. The network exposure is indirect, as it typically occurs during the processing of untrusted or externally sourced git repositories."
}