Vulnerability

CVE-2026-100419

Descriptive record received from OpenCTI and minimised for consultation in the Intel portal.

Sharing: PUBLIC-OSINT
Confidence: 100
Source: The CVE Program
Updated: 26/09/2026 03:48

Description

gitoxide gix-fs before 0.23.0 contains a path validation bypass vulnerability in the worktree checkout mechanism that allows attackers to escape the worktree directory via symlink manipulation. During forced checkout with overwrite_existing enabled, attackers can craft malicious repository trees where symlink entries replace validated directories, causing subsequent files to be written outside the worktree through the symlink for code execution or file manipulation.

STIX identifiervulnerability--ce9ffa8f-02ed-5fe8-a7a3-a265ee53b9b2

First observation-

Last observation-

Known relationships10

Aliases and classifications

CWE-59Improper Link Resolution Before File Access ('Link Following')

Minimised technical details

No raw data

cisa kev: False
cvss score: 7
cvss vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
cvss severity: HIGH

Provenance

Public references

GitHub Security Advisory (GHSA-6p9q-f2xg-6pr5)
https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-6p9q-f2xg-6pr5
product
https://github.com/GitoxideLabs/gitoxide
https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-f89h-2fjh-2r9q
https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-f89h-2fjh-2r9q
gix-fs 0.22.1 stack.rs pop loop and disarmed guard
https://github.com/GitoxideLabs/gitoxide/blob/gix-fs-v0.22.1/gix-fs/src/stack.rs
VulnCheck Advisory: gitoxide gix-fs before 0.23.0 Worktree Escape via Symlink
https://www.vulncheck.com/advisories/gitoxide-gix-fs-before-0.23.0-worktree-escape-via-symlink
Patch Commit
https://github.com/GitoxideLabs/gitoxide/commit/b62498378b8bc2c95863a044b700f2063b0b5875

EudorIA correlation

Intel catalogue

The vulnerability is also available in the EudorIA editorial catalogue.

Open EudorIA analysis

Presence in OpenCTI describes an intelligence correlation and does not, by itself, constitute evidence of compromise, legal attribution or operational guidance applicable without context verification.