CVE-2026-44471: gitoxide Path Traversal Vulnerability

CVE-2026-44471 Overview

CVE-2026-44471 is a symlink handling flaw in gitoxide, a Rust implementation of git, affecting versions prior to 0.21.1. A malicious tree object can bypass on-disk collision checks during checkout, allowing an attacker to write an attacker-controlled symlink into any directory the user has write access to. The flaw resides in the path-prefix caching logic of gix_fs::Stack::make_relative_path_current(), which skips the create_leading_directory() safety check on cached prefixes. Exploitation requires a victim to check out a crafted repository using gitoxide. The issue is tracked under CWE-59: Improper Link Resolution Before File Access and is fixed in version 0.21.1.

Critical Impact
A crafted git tree can cause gitoxide to write attacker-controlled symlinks into arbitrary writable directories, enabling file overwrite and potential code execution in the user's context.

Affected Products

gitoxide versions prior to 0.21.1
The gix-fs crate (path stack component)
The gix-worktree crate (checkout delegate component)

Discovery Timeline

2026-05-13 - CVE-2026-44471 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-44471

Vulnerability Analysis

The vulnerability is a symlink attack (CWE-59) in the gitoxide checkout pipeline. During checkout, gitoxide defers all symlink index entries and creates them after regular files using a shared gix_worktree::Stack. The underlying gix_fs::Stack caches validated path prefixes to avoid redundant filesystem work.

When the previously processed leaf component matches the leading components of the next path, the leaf-to-directory transition in gix-fs/src/stack.rs calls only delegate.push_directory() and never delegate.push(). The on-disk symlink_metadata() check and the unlink-on-collision logic live inside StackDelegate::push(), specifically in its call to create_leading_directory(). Cached prefixes bypass this code path entirely.

The final symlink is created using std::os::unix::fs::symlink, which follows symlinks already present in parent directories. An attacker crafting a tree with duplicate symlink and directory entries can chain these primitives to redirect writes outside the working tree.

Root Cause

The root cause is an inconsistency between the path-caching fast path and the slow path in gix_fs::Stack. When the StackDelegate state is State::CreateDirectoryAndAttributesStack, Attributes::push_directory() only loads attributes from the object database and performs no collision or symlink checks. The safety validation is unreachable for prefixes already cached as a leaf.

Attack Vector

Exploitation requires user interaction: the victim must check out a malicious repository with a vulnerable gitoxide version. The attacker constructs a tree containing duplicate entries where a symlink entry and a directory entry share path components. On checkout, the symlink is materialized first, and subsequent entries traverse through it because the cached prefix skips the unlink-on-collision routine. The attacker can then write files into any directory the user can write to.

No verified public proof-of-concept code is available. See the GitHub Security Advisory GHSA-f89h-2fjh-2r9q for the maintainer's technical breakdown.

Detection Methods for CVE-2026-44471

Indicators of Compromise

Unexpected symlinks appearing in working tree parent directories after a gitoxide checkout or clone operation.
Git tree objects containing duplicate path entries where one entry is a symlink and another is a directory sharing the same prefix.
File modifications outside the repository root following operations performed by tools that embed gix or gitoxide.

Detection Strategies

Audit installed Rust toolchains and applications for dependencies on gix, gitoxide, or gix-worktree at versions below 0.21.1.
Inspect incoming repositories for tree objects with duplicate entries before checkout, using git ls-tree or equivalent inspection tooling.
Monitor process execution for gitoxide-based binaries followed by symlink creation system calls (symlinkat, symlink) targeting paths outside the expected working directory.

Monitoring Recommendations

Enable Linux audit rules on symlink and symlinkat syscalls for developer workstations and CI runners that consume untrusted repositories.
Track file integrity for sensitive paths such as ~/.ssh/, ~/.config/, and shell startup files that an attacker would likely target via symlink redirection.
Review CI/CD pipelines for usage of gitoxide-based clone tools against external pull requests or untrusted sources.

How to Mitigate CVE-2026-44471

Immediate Actions Required

Upgrade gitoxide and all dependent crates to version 0.21.1 or later across developer machines, build agents, and CI systems.
Audit Cargo.lock files for transitive dependencies on vulnerable gix-fs and gix-worktree versions and rebuild affected applications.
Avoid checking out untrusted repositories with gitoxide-based tooling until the upgrade is verified across the environment.

Patch Information

The vulnerability is fixed in gitoxide 0.21.1. The patch closes the gap between the cached-prefix fast path and the validated slow path, ensuring create_leading_directory() runs for prefix transitions. Refer to the GitHub Security Advisory GHSA-f89h-2fjh-2r9q for the upstream commit references.

Workarounds

Restrict gitoxide-based checkout operations to trusted repositories only until the upgrade is applied.
Run checkout operations of untrusted code inside ephemeral containers or sandboxes that limit write access to a disposable directory.
Where possible, fall back to canonical git for cloning untrusted sources until the gitoxide upgrade is rolled out.

bash

# Configuration example: upgrade gitoxide crates to the patched version
cargo update -p gix --precise 0.21.1
cargo update -p gix-worktree
cargo update -p gix-fs
cargo audit