Gitoxide versions prior to 0.52.1 do not validate submodule names specified in a repository’s .gitmodules file, allowing attackers to create names that contain directory traversal components. When Gitoxide processes such an entry, internal functions that resolve repository directories are steered to locations outside the expected .git/modules directory. This flaw can cause Gitoxide to create or access repositories chosen by the attacker, resulting in unauthorized inspection of attacker‑controlled repository contents or the potential for further local compromise. The vulnerability therefore permits path traversal that grants access to arbitrary file-system locations relative to the repository root.

All instances of GitoxideLabs Gitoxide with a version earlier than 0.52.1 are affected. This includes every build of the library released before the 0.52.1 update, regardless of how it is deployed or the operating system it runs on.

The CVSS score of 8.7 indicates a high severity issue. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to be able to insert a malicious submodule name into a repository’s .gitmodules file; the exact method by which this occurs is not detailed in the CVE, so the precise attack vector is not specified but would involve some form of write access to the repository configuration. Once a malicious entry is present, normal Gitoxide operation triggers the path traversal, exposing the attacker‑controlled repository to the client. The lack of an EPSS score means current exploitation likelihood cannot be quantified, but the vulnerability’s nature and high CVSS score warrant prompt remediation.