{
  "cveId": "CVE-2026-82251",
  "url": "https://patchblox.com/security/cve/CVE-2026-82251",
  "summary": "CVE-2026-82251 is fixed in 4 products on 1 platform, first by DEBIAN-CVE-2026-82251, released September 5, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "gitoxide before 0.52.1 Path Traversal via Submodule Name",
  "description": "gitoxide before 0.52.1 fails to validate submodule names from .gitmodules configuration, allowing path traversal when deriving submodule git directories. Attackers can craft malicious submodule names with traversal segments to redirect state() and open() functions to repositories outside .git/modules, causing repository confusion and inspection of attacker-controlled repositories.",
  "published": "2026-08-28T12:16:37Z",
  "severity": "Important",
  "cvss": 7.5,
  "cwe": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
  "epss": 0.00522,
  "epssPercentile": 0.44794,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-82251",
  "fixes": [
    {
      "platform": "linux",
      "product": "cargo-c",
      "release": "amzn 2023",
      "fixedVersion": "0.10.25-1.amzn2023.0.1",
      "fix": "ALAS2023-2026-3181",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3181",
      "released": "2026-11-07T01:06:07Z"
    },
    {
      "platform": "linux",
      "product": "cargo-c-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "0.10.25-1.amzn2023.0.1",
      "fix": "ALAS2023-2026-3181",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3181",
      "released": "2026-11-07T01:06:07Z"
    },
    {
      "platform": "linux",
      "product": "rust-cargo-c-debugsource",
      "release": "amzn 2023",
      "fixedVersion": "0.10.25-1.amzn2023.0.1",
      "fix": "ALAS2023-2026-3181",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3181",
      "released": "2026-11-07T01:06:07Z"
    },
    {
      "platform": "linux",
      "product": "rust-gix",
      "release": "Debian 14",
      "fixedVersion": "0.83.0-1",
      "fix": "DEBIAN-CVE-2026-82251",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-82251",
      "released": "2026-09-05T01:57:10Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-11T13:47:35Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}