Read the docs
TI-2026-56713 Aliases CVE-2026-82248GHSA-r399-grgc-5vpp

gitoxide before 0.33.0 Path Traversal via symlink following

Priority MEDIUM 60CWE-59Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
High
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

gix-worktree-state before 0.33.0 (part of gitoxide) allows writing files outside the worktree on Windows. gix_worktree_state::checkout() follows an existing terminal symlink during non-exclusive (incremental) materialization (destination_is_initially_empty: false) when core.symlinks is true. If a symlink entry (mode 120000) is first checked out at a path P pointing outside the worktree, a subsequent incremental checkout of a regular-file entry (mode 100644) at the same path follows the existing reparse point and writes the blob content through the link, overwriting files outside the worktree.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00339 27th percentileScored 2026-11-07
Fix Fixed gitoxide (GitoxideLabs): 0.33.0, 0.55.0, 0.49.0 +1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GitoxideLabsgitoxidebefore 0.33.00.33.0Patch availableCNA
GitoxideLabsgitoxidebefore 0.55.00.55.0Patch availableCNA
GitoxideLabsgitoxidebefore 0.49.00.49.0Patch availableCNA
GitoxideLabsgitoxidebefore 0.86.00.86.0Patch availableCNA
  • gitoxide VendorGitoxideLabs Affected before 0.33.0 Fixed in 0.33.0 Patch available CNA
  • gitoxide VendorGitoxideLabs Affected before 0.55.0 Fixed in 0.55.0 Patch available CNA
  • gitoxide VendorGitoxideLabs Affected before 0.49.0 Fixed in 0.49.0 Patch available CNA
  • gitoxide VendorGitoxideLabs Affected before 0.86.0 Fixed in 0.86.0 Patch available CNA

Remediation

  • Fix · CNA gitoxide (GitoxideLabs) Fixed in 0.33.0
  • Fix · CNA gitoxide (GitoxideLabs) Fixed in 0.55.0
  • Fix · CNA gitoxide (GitoxideLabs) Fixed in 0.49.0
  • Fix · CNA gitoxide (GitoxideLabs) Fixed in 0.86.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-82248
  2. 2026-10-03 Alias added: GHSA-r399-grgc-5vpp

References

Advisory 1

  • TI-2026-56719 gitoxide before 0.69.0 Denial of Service via gix-pack CVSS 4.0HIGH 8.7
  • TI-2026-56718 gitoxide before 0.82.0 Path Traversal via Submodule Name Validation Bypass CVSS 4.0HIGH 8.7
  • TI-2026-56717 gitoxide before 0.52.1 Repository Boundary Violation via symlinked .gitmodules CVSS 4.0HIGH 8.7
  • TI-2026-56716 gitoxide before 0.52.1 Path Traversal via Submodule Name CVSS 4.0HIGH 8.7
  • TI-2026-56712 gitoxide before 0.37.1 HTTP Basic credential leak via URL parsing CVSS 4.0HIGH 8.7
  • TI-2026-32410 gitoxide: Symlink prefix-reuse allows worktree escape during checkout CVSS 3.1HIGH 7.8
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences