The vulnerability is a path traversal flaw in the gix-validate component of gitoxide: the submodule name validation function only checks for the first occurrence of '..', allowing crafted names such as 'a..b/../../../.git/' to bypass the validation. Combined with a trust inheritance flaw in Submodule::open(), which clones the parent repository’s git_dir_trust without performing ownership verification, an attacker can cause a victim tool built on gitoxide to read arbitrary files from the repository. This flaw does not provide an immediate code‑execution path but enables sensitive data disclosure and credential compromise.

This flaw affects Gitoxide Labs’ gitoxide library as distributed via the Rust crates gix (versions <= 0.72.0) and gix-validate (versions <= 0.10.0). The issue was fixed in gix 0.82.0 and gix-validate 0.11.1.

The CVSS score of 8.7 places the vulnerability in the high severity range and indicates significant impact. Documentation does not provide an EPSS value; the KEV status is false, indicating it is not listed, implying no confirmed exploitation yet. The likely attack vector is local: an attacker who can place a malicious .gitmodules file in a repository that a tool based on gitoxide will process can bypass safe-directory protections and read the repository’s configuration—including embedded credentials—by exploiting the unchecked trust in git_dir_trust. The flaw does not provide an immediate code‑execution path but enables sensitive data disclosure and credential compromise.