GHSA-xw69-xv93-5fjv: gix-fs before 0.24.1 NTLM Credential Disclosure via Windows Symlink UNC Probe

Published Nov 8, 2026

Updated

gix-fs in gitoxide before 0.24.1 contains a credential disclosure vulnerability that allows remote attackers to capture NTLM credentials by supplying UNC symlink targets in a crafted repository. When a victim checks out the repository on Windows with symlinks enabled, gixfs::symlink::create calls isdir() on the UNC target, triggering SMB authentication that leaks the username, domain, and NTLMv2 hash.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade gix-fs to a version that resolves this vulnerability.
Fixed in 0.24.1

Event History

Nov 8, 2026

CVE Published

via OSV·01:37 AM

Data Sourced

via OSV·01:37 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Windows users of gix-fs versions before 0.24.1 are exposed when they check out a crafted repository with symlinks enabled. The crafted symlink must point to a UNC target.

What does an attacker need to do to exploit it?

An attacker needs to supply a crafted repository containing a symlink whose target is a UNC path. During checkout, gix_fs::symlink::create calls is_dir() on that target, causing SMB authentication.

What information can be disclosed?

The SMB authentication can disclose the victim's username, domain, and NTLMv2 hash to the remote attacker.

GHSA-xw69-xv93-5fjv: gix-fs before 0.24.1 NTLM Credential Disclosure via Windows Symlink UNC Probe

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to exploit it?

What information can be disclosed?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to exploit it?

What information can be disclosed?