CVE-2026-82248: gitoxide before 0.33.0 Path Traversal via symlink following
gix-worktree-state before 0.33.0 (part of gitoxide) allows writing files outside the worktree on Windows. gixworktreestate::checkout() follows an existing terminal symlink during non-exclusive (incremental) materialization (destinationisinitiallyempty: false) when core.symlinks is true. If a symlink entry (mode 120000) is first checked out at a path P pointing outside the worktree, a subsequent incremental checkout of a regular-file entry (mode 100644) at the same path follows the existing reparse point and writes the blob content through the link, overwriting files outside the worktree.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
The affected behavior is on Windows in gix-worktree-state before 0.33.0. It requires core.symlinks to be enabled and a non-exclusive incremental materialization where the destination is not initially empty.
What checkout sequence is required for an outside-worktree write?
A symlink entry at a path must first be checked out pointing outside the worktree. A later incremental checkout must then materialize a regular file at that same path, causing the existing Windows reparse point to be followed and the file content to be written through it.