HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-100419 — gitoxide gix-fs before 0.23.0 contains a path validation bypass vulnerability in...

·Source: NIST NVD

Updated:

Executive Summary

gitoxide gix-fs before 0.23.0 contains a path validation bypass vulnerability in the worktree checkout mechanism that allows attackers to escape the worktree directory via symlink manipulation. During forced checkout with overwrite_existing enabled, attackers can craft malicious repository trees where symlink entries replace validated directories, causing subsequent files to be written outside the

Analysis

gitoxide gix-fs before 0.23.0 contains a path validation bypass vulnerability in the worktree checkout mechanism that allows attackers to escape the worktree directory via symlink manipulation. During forced checkout with overwrite_existing enabled, attackers can craft malicious repository trees where symlink entries replace validated directories, causing subsequent files to be written outside the worktree through the symlink for code execution or file manipulation. CVSS Score: 7. Published: 2026-09-25T22:17:10.613.

Indicators of Compromise (1)

CVE (1)
CVE-2026-100419
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Sep 25, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

SWIFT Banking & Government Middleware Enables RCE

Patch middleware vulnerabilities now to avoid hardware-based MFA exploits in ultra-sensitive environments.

Dark Reading
CRITICALVulnerability

GitLab warns of critical RCE vulnerability in AI Gateway service

GitLab warned customers today to immediately patch a critical AI Gateway vulnerability that could let attackers run arbitrary commands on vulnerable instances. [...]

BleepingComputer
MEDIUMVulnerability

Is Your Organization Ready for 2027's AI Accountability Era?

Organizations may face an artificial intelligence (AI) reckoning over the next year. Omdia and Gartner weigh in on how to tackle the governance, security, and value challenges ahead.

Dark Reading