Symlink Vulnerability in Ciguard CI/CD Static Security Auditor

CVE-2026-44220

What is CVE-2026-44220?

Ciguard, a static security auditor designed for CI/CD pipelines, is affected by a vulnerability that arises from its discover_pipeline_files() function. In versions 0.8.0 to 0.8.1, the function traverses directory trees and follows symbolic links, potentially leading to unauthorized access to files outside the designated root directory. If an attacker is able to place a symlink within a scanned directory, they can manipulate the discovery process to unintentionally include paths to sensitive files. This issue has been addressed in version 0.8.2.

References