CVE-2026-82248

Deferred Deferred - Pending Action

Symlink-Based File Write in gitoxide gix-worktree-state

Publication date: 2026-08-28

Last updated on: 2026-08-31

Assigner: VulnCheck

Description

gix-worktree-state before 0.33.0 (part of gitoxide) allows writing files outside the worktree on Windows. gix_worktree_state::checkout() follows an existing terminal symlink during non-exclusive (incremental) materialization (destination_is_initially_empty: false) when core.symlinks is true. If a symlink entry (mode 120000) is first checked out at a path P pointing outside the worktree, a subsequent incremental checkout of a regular-file entry (mode 100644) at the same path follows the existing reparse point and writes the blob content through the link, overwriting files outside the worktree.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-31

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-82248

EUVD

EUVD-2026-67700

Affected Vendors & Products

Vendor	Product	Version / Range
gitoxide	gix_worktree_state	0.33.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-59	The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

Executive Summary

This vulnerability in gix-worktree-state before 0.33.0 allows writing files outside the worktree on Windows systems. It occurs when a symlink points outside the worktree and a regular file is checked out to the same path, causing the file content to be written through the symlink, overwriting external files.

Detection Guidance

This vulnerability affects systems using gitoxide on Windows with core.symlinks enabled. To detect it, check for symlinks pointing outside the worktree and verify file writes during incremental checkouts. No specific commands are provided in the context.

Impact Analysis

This vulnerability could allow an attacker to overwrite critical system files or sensitive data outside the intended worktree directory. This may lead to data corruption, unauthorized modifications, or denial of service if important files are overwritten.

Compliance Impact

This vulnerability allows writing files outside the intended worktree on Windows systems, which could lead to unauthorized file modifications or data exfiltration. Such behavior may violate compliance requirements under GDPR (data protection) or HIPAA (health data security) by enabling unauthorized access or tampering with sensitive files.

Mitigation Strategies

Update gix-worktree-state to version 0.33.0 or later to address the symlink handling issue. Avoid using core.symlinks=true on Windows systems to prevent following terminal symlinks outside the worktree.

Hi! I’m here to help you understand CVE-2026-82248. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70