CVE-2026-100419: gitoxide gix-fs Path Traversal Vulnerability

CVE-2026-100419 Overview

CVE-2026-100419 is a path validation bypass vulnerability in gitoxidegix-fs versions before 0.23.0. The flaw resides in the worktree checkout mechanism and allows attackers to escape the worktree directory through symlink manipulation. During a forced checkout with overwrite_existing enabled, a crafted repository tree can replace a previously validated directory with a symlink entry. Subsequent files are then written outside the worktree via that symlink, enabling arbitrary file write and potential code execution. The weakness is classified as a symlink following issue [CWE-59].

Critical Impact

Arbitrary file write outside the intended worktree directory, which can lead to code execution when writes land on executable paths or startup files.

Affected Products

• gitoxidegix-fs crate versions prior to 0.23.0
• Rust applications and tooling that embed gix-fs for worktree checkout operations
• Downstream gitoxide consumers performing forced checkouts with overwrite_existing enabled

Discovery Timeline

• 2026-09-25 - CVE-2026-100419 published to NVD
• 2026-09-28 - Last updated in NVD database

Technical Details for CVE-2026-100419

Vulnerability Analysis

The vulnerability affects the path stack logic in gix-fs/src/stack.rs. The stack caches terminal path entries during checkout to avoid redundant filesystem validation. Attackers abuse this cache by introducing a symlink entry that shadows a path component previously validated as a directory. Because the cached entry is reused without revalidation, writes resolve through the attacker-controlled symlink target. The result is a worktree escape that places files outside the intended checkout root.

Root Cause

The root cause is improper revalidation of cached terminal entries in the gix-fs path stack. The current_is_directory flag tracked the state of the current path element but did not detect when a tree entry mutated that element into a symlink. When overwrite_existing is set during forced checkout, the stack reuses the stale directory assumption and follows the symlink. This matches the [CWE-59] link following pattern.

Attack Vector

Exploitation requires local access and user interaction, specifically the act of checking out a malicious repository with forced overwrite semantics. The attacker crafts a tree object where sibling entries sequence a directory followed by a symlink replacing that directory, followed by file entries targeting paths under the replaced component. When gitoxide processes the tree, it writes those files through the symlink to locations outside the worktree. The attack complexity is elevated by the need to win the ordering and the requirement that the consumer invoke forced checkout.

    current_relative: PathBuf,
    /// The amount of path components of 'current' beyond the roots components.
    valid_components: usize,
-    /// If set, we assume the `current` element is a directory to affect calls to `(push|pop)_directory()`.
+    /// Whether `current` has active delegate directory state, rather than being a terminal entry.
    current_is_directory: bool,
}

Source: Gitoxide Commit b624983 — the patch revalidates cached terminal entries before reusing them.

Detection Methods for CVE-2026-100419

Indicators of Compromise

• Files written outside a repository worktree during or immediately after a gitoxide checkout operation.
• Repository tree objects that contain a directory entry and a symlink entry sharing the same name within the same tree.
• Unexpected symlinks created inside a worktree whose targets resolve to absolute paths or to parent directories using .. traversal.

Detection Strategies

• Audit Rust dependency manifests for gix-fs versions below 0.23.0 using cargo tree or SBOM scanning.
• Inspect checkout operations invoked with overwrite_existing and log the resolved absolute paths of all written files for out-of-root deviations.
• Scan repositories before checkout for tree entries that mix directory and symlink objects at the same path.

Monitoring Recommendations

• Monitor filesystem events for symlink creation followed by file writes that traverse the symlink target during Git tooling execution.
• Alert on process executions of gitoxide-based binaries that write outside the current working directory tree.
• Track supply chain feeds and GitHub Security Advisories GHSA-6p9q-f2xg-6pr5 and GHSA-f89h-2fjh-2r9q for related updates.

How to Mitigate CVE-2026-100419

Immediate Actions Required

• Upgrade gix-fs to version 0.23.0 or later across all Rust projects and transitive dependency graphs.
• Rebuild and redeploy any application, CLI, or service that embeds gitoxide for repository checkout.
• Avoid checking out untrusted repositories with forced overwrite semantics until the upgrade is in place.

Patch Information

The fix landed in gitoxide commit b62498378b8bc2c95863a044b700f2063b0b5875, which revalidates cached terminal entries in the gix-fs path stack before reuse. Details are published in the GitHub Security Advisory GHSA-6p9q-f2xg-6pr5 and the related GHSA-f89h-2fjh-2r9q. Additional analysis is available in the VulnCheck Advisory on Gitoxide.

Workarounds

• Disable overwrite_existing in checkout configurations until the patched version is deployed.
• Perform checkouts into ephemeral containers or sandboxed filesystems that constrain writes to a bind-mounted worktree.
• Pre-scan tree objects to reject entries where a directory and a symlink share the same path name within a single tree.

# Update gix-fs to the patched release
cargo update -p gix-fs --precise 0.23.0
# Verify no vulnerable versions remain in the dependency tree
cargo tree -i gix-fs