{
  "cveId": "CVE-2026-82251",
  "url": "https://patchblox.com/security/cve/CVE-2026-82251",
  "summary": "CVE-2026-82251 is fixed in rust-gix on 1 platform by DEBIAN-CVE-2026-82251 (version 0.83.0-1), released September 5, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "gitoxide before 0.52.1 Path Traversal via Submodule Name",
  "description": "gitoxide before 0.52.1 fails to validate submodule names from .gitmodules configuration, allowing path traversal when deriving submodule git directories. Attackers can craft malicious submodule names with traversal segments to redirect state() and open() functions to repositories outside .git/modules, causing repository confusion and inspection of attacker-controlled repositories.",
  "published": "2026-08-28T12:16:37Z",
  "severity": "Important",
  "cvss": 7.5,
  "cwe": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
  "epss": 0.00522,
  "epssPercentile": 0.44592,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-82251",
  "fixes": [
    {
      "platform": "linux",
      "product": "rust-gix",
      "release": "Debian 14",
      "fixedVersion": "0.83.0-1",
      "fix": "DEBIAN-CVE-2026-82251",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-82251",
      "released": "2026-09-05T01:57:10Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T19:12:23Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}