UBUNTU-CVE-2026-82251

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2026-82251
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-82251.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-82251
Upstream
Published
2026-08-31T00:00:00Z
Modified
2026-08-31T22:15:53.705021078Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
  • Ubuntu - medium
Summary
[none]
Details

gitoxide before 0.52.1 fails to validate submodule names from .gitmodules configuration, allowing path traversal when deriving submodule git directories. Attackers can craft malicious submodule names with traversal segments to redirect state() and open() functions to repositories outside .git/modules, causing repository confusion and inspection of attacker-controlled repositories.

References

Affected packages

Ubuntu:26.04:LTS / rust-gix

Package

Name
rust-gix
Purl
pkg:deb/ubuntu/rust-gix?arch=source&distro=resolute

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.69.1-1
0.69.1-2
0.73.0-1
0.73.0-1build1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "0.73.0-1build1",
            "binary_name": "librust-gix-dev"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-82251.json"