File Protection Bypass Vulnerability in Gittuf by Gittuf

CVE-2026-128034

What is CVE-2026-128034?

In versions prior to 0.18.0 of Gittuf, a vulnerability exists that allows unauthorized users to bypass file protection rules. The issue arises due to the verification process relying on quoted and escaped pathnames when handling files with special characters, such as non-ASCII characters. This misconfiguration means that these files do not match the expected protection patterns, leading to a scenario where unauthorized users can modify protected files without detection. It is essential to upgrade to version 0.18.0 or later to mitigate this risk.

References