CVE-2026-100419
gitoxide gix-fs before 0.23.0 Worktree Escape via Symlink
- State
- Published
- Severity
- 7.3 High
- Published
- Sep 25, 2026
- Updated
- Sep 28, 2026
- Reserved
- Sep 25, 2026
Description
gitoxide gix-fs before 0.23.0 contains a path validation bypass vulnerability in the worktree checkout mechanism that allows attackers to escape the worktree directory via symlink manipulation. During forced checkout with overwrite_existing enabled, attackers can craft malicious repository trees where symlink entries replace validated directories, causing subsequent files to be written outside the worktree through the symlink for code execution or file manipulation.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.3 High | CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.0 High | CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-59 Improper Link Resolution Before File Access ('Link Following')
Affected Products
| Product | Versions |
|---|---|
gitoxideGitoxideLabs |
|
References
- GitHub Security Advisory (GHSA-6p9q-f2xg-6pr5)vendor-advisory
- Patch Commitpatch
- gix-fs 0.22.1 stack.rs pop loop and disarmed guardtechnical-description
- GitHub Security Advisory (GHSA-f89h-2fjh-2r9q)relatedvendor-advisory
- https://github.com/GitoxideLabs/gitoxideproduct
- VulnCheck Advisory: gitoxide gix-fs before 0.23.0 Worktree Escape via Symlinkthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.