CVE-2026-82251: 
CBL Mariner vulnerability analysis and mitigation

CVE-2026-82251 is a path traversal vulnerability in gitoxide (a Rust-based Git implementation by GitoxideLabs) that allows attackers to redirect submodule repository resolution outside the intended .git/modules directory. Versions before 0.52.1 (and before 0.82.0 in a separate version line) are affected. The vulnerability was published on August 28, 2026, with a patch released the same day. It carries a CVSS v3.1 score of 7.5 (High) and a CVSS v4.0 score of 8.7 (High) (GitHub Advisory, GHSA-fr8x-3vfx-f45h).

The root cause is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). In gix-submodule/src/access.rs, submodule names are read directly from .gitmodules configuration without validation, and in gix/src/submodule/mod.rs, the git directory is derived by concatenating common_dir().join("modules").join(name) with no confinement check. A crafted submodule name such as ../../../escaped-target.git traverses out of .git/modules after path normalization, causing both state() and open() to operate on an attacker-chosen repository path. A proof-of-concept (PoC) zip archive (pocs.zip) was included in the original security advisory, demonstrating that repository_exists=true and submodule_opened=true are returned for the traversed path (GHSA-fr8x-3vfx-f45h).

Successful exploitation allows an unauthenticated attacker to redirect gitoxide's submodule inspection functions (state() and open()) to arbitrary repository paths outside .git/modules, enabling disclosure of repository contents from unintended filesystem locations. The primary impact is high confidentiality loss — callers that enumerate, inspect, or operate on submodules can be steered into using an attacker-controlled repository object. No integrity or availability impact has been demonstrated; remote code execution has not been claimed from this behavior alone (GHSA-fr8x-3vfx-f45h, GitHub Advisory).

A PoC was included in the original security advisory (attached as pocs.zip), and NVD's SSVC assessment classifies exploitation as "poc" with automatable attack potential. The EPSS score is approximately 0.387% (32nd percentile), indicating a relatively low near-term exploitation probability. No in-the-wild exploitation has been observed, and the vulnerability is not listed in the CISA KEV catalog. The attack requires no authentication, no user interaction, and no special privileges — only the ability to supply a malicious .gitmodules file to a target processing submodules with gitoxide (GitHub Advisory, GHSA-fr8x-3vfx-f45h).

1. Craft a malicious repository: Create a Git repository containing a .gitmodules file with a submodule name that includes path traversal segments, e.g., [submodule "../../../escaped-target.git"] with a corresponding URL.
2. Place attacker-controlled repository: Ensure a repository exists at the traversal target path (e.g., artifacts/escaped-target.git) on the victim's filesystem, or rely on an existing repository at a predictable location.
3. Deliver the malicious repository: Host the crafted repository on a server or share it with a victim who will clone or process it using a gitoxide-based tool (e.g., gix clone or an application using the gitoxide Rust crate).
4. Trigger submodule processing: When the victim's gitoxide-based application processes submodules (e.g., via Submodule::state() or Submodule::open()), the unvalidated name is joined directly to the modules path, resolving to the attacker-chosen path outside .git/modules.
5. Achieve repository redirection: The application now operates on the attacker-chosen repository — state() reports repository_exists=true for the traversed path and open() returns a repository object backed by that path, enabling inspection and disclosure of its contents (GHSA-fr8x-3vfx-f45h).

• File System: Presence of .gitmodules files containing submodule names with path traversal sequences (e.g., ../, ..\, or URL-encoded equivalents); unexpected repository directories outside .git/modules being accessed or created.
• Logs: Application logs from gitoxide-based tools showing submodule paths resolving to locations outside the expected .git/modules/ directory; errors or unexpected success messages from state() or open() calls referencing paths with traversal segments.
• Process: Rust applications using the gitoxide crate accessing filesystem paths outside the repository's .git/modules directory during submodule enumeration or inspection operations (GHSA-fr8x-3vfx-f45h).

Upgrade gitoxide to version 0.52.1 or later (or 0.82.0 or later for the parallel version line), which adds validation and confinement checks for submodule names before they are used as filesystem path components. As a workaround, restrict git operations to trusted repositories only and avoid processing untrusted .gitmodules files with gitoxide-based tools. Additionally, implement input validation to reject submodule names containing path traversal sequences (../, ..\) or path separators before passing them to gitoxide APIs (GHSA-fr8x-3vfx-f45h, GitHub Advisory).

The vulnerability was reported by security researcher N0zoM1z0 and published by the gitoxide maintainer (Byron) via GitHub Security Advisories. Brief mentions appeared on Mastodon and vulnerability aggregator sites shortly after disclosure, but no significant broader media coverage or notable researcher commentary beyond the advisory itself has been identified (GHSA-fr8x-3vfx-f45h).