UBUNTU-CVE-2026-123532: High severity ubuntu/rust-gix-fs vulnerability
gix-fs in gitoxide before 0.24.1 contains a credential disclosure vulnerability that allows remote attackers to capture NTLM credentials by supplying UNC symlink targets in a crafted repository. When a victim checks out the repository on Windows with symlinks enabled, gixfs::symlink::create calls isdir() on the UNC target, triggering SMB authentication that leaks the username, domain, and NTLMv2 hash.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
gix-fsto a version that resolves this vulnerability.Fixed in 0.24.1
Event History
Frequently Asked Questions
Which environments are exposed to this issue?
The reported exposure requires a Windows victim checking out a crafted repository with symlinks enabled. Systems not performing that Windows checkout scenario are not described as affected by the available data.
What must an attacker provide to trigger credential disclosure?
An attacker must supply a crafted repository containing symlinks whose targets are UNC paths. During checkout, the vulnerable code checks whether the UNC target is a directory, which can initiate SMB authentication.
What information can be disclosed?
The SMB authentication can expose the victim's username, domain, and NTLMv2 hash to the remote attacker. The provided data does not describe integrity or availability impact.
What can be done before patching?
Avoid checking out untrusted repositories on Windows with symlinks enabled. The vulnerable behavior is reported in gix-fs versions before 0.24.1, so updating to 0.24.1 or later addresses the affected version range.
How can I identify potentially affected use?
Identify deployments using gix-fs before 0.24.1 and determine whether they check out repositories on Windows with symlinks enabled. Review repositories from untrusted sources for symlinks targeting UNC paths.