Path Traversal Vulnerability in gix-worktree-state on Windows

CVE-2026-82248

What is CVE-2026-82248?

The gix-worktree-state component prior to version 0.33.0 from Gitoxide is susceptible to a path traversal vulnerability on Windows. This issue arises when the checkout function follows an existing terminal symlink during non-exclusive materialization processes. If symlinks are enabled, and a symlink pointing outside the worktree is checked out, subsequent checkouts of regular file entries can lead to overwriting files outside the expected directory. This behavior exposes sensitive files to unintended modification, posing a significant risk to the integrity of the file system.

References