Path Traversal in gitoxide gix-fs

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: VulnCheck

Description

gitoxide gix-fs before 0.23.0 contains a path validation bypass vulnerability in the worktree checkout mechanism that allows attackers to escape the worktree directory via symlink manipulation. During forced checkout with overwrite_existing enabled, attackers can craft malicious repository trees where symlink entries replace validated directories, causing subsequent files to be written outside the worktree through the symlink for code execution or file manipulation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-25

Generated

2026-09-26

AI Q&A

2026-09-26

EPSS Evaluated

N/A

NVD

CVE-2026-100419

Affected Vendors & Products

Vendor	Product	Version / Range
gitoxide	gix-fs	to 0.23.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-59	The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

Executive Summary

This vulnerability in gitoxide gix-fs before 0.23.0 allows attackers to bypass path validation during worktree checkout. By using symlink manipulation, they can escape the intended worktree directory and write files outside of it. This occurs specifically when forced checkout with overwrite_existing is enabled, enabling potential code execution or file manipulation outside the expected directory.

Impact Analysis

If you use gitoxide gix-fs before 0.23.0, attackers could exploit this to overwrite critical system files, execute arbitrary code, or manipulate files outside your intended worktree directory. This could lead to system compromise, unauthorized data access, or persistent malware installation on your machine.

Mitigation Strategies

Update gitoxide gix-fs to version 0.23.0 or later to address the path validation bypass in the worktree checkout mechanism.

Hi! I’m here to help you understand CVE-2026-100419. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70