Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale. Voir CVE-2026-82251 →

DEBIAN-CVE-2026-82251

gitoxide before 0.52.1 fails to validate submodule names from .gitmodules configuration, allowing path traversal when deriving submodule git directori...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

gitoxide before 0.52.1 fails to validate submodule names from .gitmodules configuration, allowing path traversal when deriving submodule git directories. Attackers can craft malicious submodule names with traversal segments to redirect state() and open() functions to repositories outside .git/modules, causing repository confusion and inspection of attacker-controlled repositories.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Paquets affectés

Debian:13 rust-gix

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 rust-gix

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.83.0-1"}]}]

Références

advisory security-tracker.debian.org