CyberRota Analysis
AI-GeneratedThe vulnerability in gitoxide prior to version 0.52.1 allows attackers to exploit improperly validated submodule names in the .gitmodules configuration, leading to potential path traversal attacks. This can result in unauthorized access to repositories outside the intended directory, enabling attackers to manipulate repository states and inspect maliciously controlled repositories. Organizations using gitoxide should prioritize patching to mitigate the risk of repository compromise and data exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
gitoxide before 0.52.1 fails to validate submodule names from .gitmodules configuration, allowing path traversal when deriving submodule git directories. Attackers can craft malicious submodule names with traversal segments to redirect state() and open() functions to repositories outside .git/modules, causing repository confusion and inspection of attacker-controlled repositories.