CVE-2026-82251

gitoxide before 0.52.1 fails to validate submodule names from .gitmodules configuration, allowing path traversal when deriving submodule git directories. Attackers can craft malicious submodule names with traversal segments to redirect state and open functions to repositories outside .git/modules...

CVE-2026-82252

gitoxide before 0.52.1 follows symlinks when reading the worktree .gitmodules file, allowing attackers to inject out-of-repository bytes into submodule metadata. Attackers can create a malicious repository with a symlinked .gitmodules pointing outside the repository tree, causing gitoxide to pars...

CVE-2023-51385_test

Verifica di CVE-2023-51385 Prima di tutto, aggiungi il seguente contenuto in /.ssh/config root@kitploit: host .example.com ProxyCommand /usr/bin/nc -X connect -x 192.0.2.0:8080 %h %p Nell'istruzione del file .gitmodules è presente un'iniezione di comandi root@kitploit: url = ssh://echo helloworld...

cve-2023-51385

CVE-2023-51385 verifizieren Zuerst muss der folgende Inhalt in /.ssh/config hinzugefügt werden: root@kitploit: host .example.com ProxyCommand /usr/bin/nc -X connect -x 192.0.2.0:8080 %h %p Die Anweisung in der .gitmodules-Datei enthält eine Befehlsinjektion: root@kitploit: url = ssh://echo...

CVE-2026-82251 gitoxide before 0.52.1 Path Traversal via Submodule Name

gitoxide before 0.52.1 fails to validate submodule names from .gitmodules configuration, allowing path traversal when deriving submodule git directories. Attackers can craft malicious submodule names with traversal segments to redirect state and open functions to repositories outside .git/modules...

CVE-2026-82252

gitoxide before 0.52.1 is vulnerable to a repository boundary violation via symlinked .gitmodules files. When reading the worktree .gitmodules file, gitoxide follows symlinks, allowing an attacker to create a malicious repository where .gitmodules points outside the repository tree. This causes g...

EUVD-2026-67703

gitoxide before 0.52.1 fails to validate submodule names from .gitmodules configuration, allowing path traversal when deriving submodule git directories. Attackers can craft malicious submodule names with traversal segments to redirect state and open functions to repositories outside .git/modules...

EUVD-2026-67704

gitoxide before 0.52.1 follows symlinks when reading the worktree .gitmodules file, allowing attackers to inject out-of-repository bytes into submodule metadata. Attackers can create a malicious repository with a symlinked .gitmodules pointing outside the repository tree, causing gitoxide to pars...

CVE-2026-82252 gitoxide before 0.52.1 Repository Boundary Violation via symlinked .gitmodules

gitoxide before 0.52.1 follows symlinks when reading the worktree .gitmodules file, allowing attackers to inject out-of-repository bytes into submodule metadata. Attackers can create a malicious repository with a symlinked .gitmodules pointing outside the repository tree, causing gitoxide to pars...

CVE-2026-82251

gitoxide before 0.52.1 fails to validate submodule names read from the .gitmodules configuration, enabling a path traversal vulnerability when deriving submodule git directories. An attacker can craft malicious submodule names containing traversal segments to redirect state() and open() calls to ...

cve-2024-32002-poc

💥 CVE-2024-32002 – Git Submodule Path Injection PoC Motivazione Durante la risoluzione della macchina Compiled della piattaforma Hack The Box, mi sono imbattuto in un comportamento curioso che coinvolge Git e sottomoduli. Investigando più a fondo, ho trovato questo eccellente post del ricercatore...

CVE-2023-51385_test

Verificação do CVE-2023-51385 Primeiro, é necessário adicionar o seguinte conteúdo em /.ssh/config root@kitploit: host .example.com ProxyCommand /usr/bin/nc -X connect -x 192.0.2.0:8080 %h %p Existe injeção de comando na declaração do arquivo .gitmodules root@kitploit: url = ssh://echo helloworld...

CVE-2023-51385_test

Verifica di CVE-2023-51385 Per prima cosa, aggiungere quanto segue in /.ssh/config root@kitploit: 主机 .example.com ProxyCommand /usr/bin/nc -X connect -x 192.0.2.0:8080 %h %p Nel file .gitmodules è presente un'iniezione di comando root@kitploit: url = ssh://echo helloworld cve.txtfoo.example.com/b...

CVE-2026-76222

A flaw was found in GitPython where it fails to properly validate submodule names within .gitmodules files. A remote attacker could craft a malicious Git repository containing specially formed submodule names with directory traversal sequences. When GitPython processes these malicious submodule...

CVE-2017-1000117

CVE-2017-1000117 Agentes mal-intencionados podem criar engenhosamente um link "ssh://..." e fazer com que a vítima acesse esse link malicioso, por exemplo, ao executar um programa, alcançando assim a execução de comandos. Esse link pode ser colocado no arquivo .gitmodules de um projeto Git, de mo...

cve-2024-32002-poc-rce

CVE-2024-32002 RCE POC Ein POC für CVE-2024-32002, der Remote Code Execution RCE demonstriert. Siehe cve-2024-32002-poc-rce für das zugehörige Submodul-Repository. Was dieses Repository enthält Ein Symlink mit einem beliebigen Namen, der auf das .git-Verzeichnis verweist. Eine .gitmodules-Datei,...

CVE-2017-1000117

CVE-2017-1000117 Como funciona? root@kitploit: $ git clone --recursive [email protected]:ikmski/CVE-2017-1000117.git Como criar este repositório root@kitploit: $ cat message.txt | gzip | base64 command $ git submodule add [email protected]:ikmski/Hello-World.git subs/CVE-2017-1000117 $...

CVE-2018-11235

CVE-2018-11235 Introduzione alla vulnerabilità Nome vulnerabilità: Vulnerabilità di sicurezza Git ID CNNVD: CNNVD-201805-1020 Livello di pericolo: Alto ID CVE: CVE-2018-11235 Tipo di vulnerabilità: Problema di caratteristica di sicurezza Data di pubblicazione: 2018-05-31 Tipo di minaccia: Remota...

CVE-2025-48384-test

Reproduktionsbefehle root@kitploit: git clone --recursive https://github.com/beishanxueyuan/CVE-2025-48384-test.git Ändern des GitHub-Repositories, auf das verwiesen wird root@kitploit: git init repo git -C repo -c protocol.file.allow=always submodule add...

DEBIAN-CVE-2026-78675

GitPython before 3.1.59 fails to disable mergeincludes when parsing .gitmodules, allowing attackers to disclose local file content by including arbitrary file paths via include directives. Attackers can craft a malicious .gitmodules file with include directives pointing to sensitive files; when...