CVE-2026-82248
Received Received - Intake

Symlink-Based File Write in gitoxide gix-worktree-state

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: VulnCheck

Description
gix-worktree-state before 0.33.0 (part of gitoxide) allows writing files outside the worktree on Windows. gix_worktree_state::checkout() follows an existing terminal symlink during non-exclusive (incremental) materialization (destination_is_initially_empty: false) when core.symlinks is true. If a symlink entry (mode 120000) is first checked out at a path P pointing outside the worktree, a subsequent incremental checkout of a regular-file entry (mode 100644) at the same path follows the existing reparse point and writes the blob content through the link, overwriting files outside the worktree.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-28
Last Modified
2026-08-28
Generated
2026-08-28
AI Q&A
2026-08-28
EPSS Evaluated
N/A
NVD
CVE-2026-82248
EUVD
EUVD-2026-67700

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
gitoxide gix_worktree_state 0.33.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-59 The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in gix-worktree-state before 0.33.0 allows writing files outside the worktree on Windows systems. It occurs when a symlink points outside the worktree and a regular file is checked out to the same path, causing the file content to be written through the symlink, overwriting external files.

Impact Analysis

This vulnerability could allow an attacker to overwrite critical system files or sensitive data outside the intended worktree directory. This may lead to data corruption, unauthorized modifications, or denial of service if important files are overwritten.

Mitigation Strategies

Update gix-worktree-state to version 0.33.0 or later to address the symlink handling issue. Avoid using core.symlinks=true on Windows systems to prevent following terminal symlinks outside the worktree.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82248. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart