CVE-2026-82248: gitoxide Path Traversal Vulnerability

CVE-2026-82248 Overview

CVE-2026-82248 affects gix-worktree-state before version 0.33.0, a component of the gitoxide project. The vulnerability allows attackers to write files outside the intended worktree on Windows systems during incremental checkout operations. The flaw stems from gix_worktree_state::checkout() following existing terminal symlinks when core.symlinks is set to true. An attacker crafts a repository that first checks out a symlink pointing outside the worktree, then materializes a regular file at the same path. The subsequent write follows the reparse point and overwrites arbitrary files. The issue is classified under CWE-59: Link Following.

Critical Impact
Malicious repositories can overwrite files outside the worktree on Windows during incremental gitoxide checkout operations, enabling integrity compromise of arbitrary filesystem locations.

Affected Products

gitoxide gix-worktree-state crate versions prior to 0.33.0
Rust applications on Windows that embed gix-worktree-state for repository checkout
Tools built on the gitoxide ecosystem performing non-exclusive (incremental) materialization with core.symlinks = true

Discovery Timeline

2026-08-28 - CVE-2026-82248 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-82248

Vulnerability Analysis

The vulnerability resides in the gix_worktree_state::checkout() function within the gitoxide project. During an incremental checkout, the function is invoked with destination_is_initially_empty: false, signaling that the target directory may already contain files from prior operations. On Windows, when core.symlinks is enabled, the checkout writes symbolic links as native reparse points rather than plain files.

The defect appears when two entries in the tree share the same path. The first entry, with git mode 120000, is written as a symlink pointing to a location outside the worktree. The second entry, with mode 100644, targets the same path as a regular file. Instead of unlinking or refusing to follow the existing reparse point, the checkout logic opens the path for writing, which Windows resolves through the symlink, and streams the blob contents to the external target.

Exploitation requires a victim to check out an attacker-controlled repository or fetch and materialize attacker-controlled refs. The result is a write primitive to any filesystem location the invoking process can reach.

Root Cause

The root cause is unsafe link following during file materialization. The checkout code does not verify that a preexisting path is a regular file before opening it for write, nor does it open the target with flags that reject reparse points. This missing symlink guard converts a benign incremental checkout into a path traversal write [CWE-59].

Attack Vector

An attacker publishes a repository containing two tree entries at the same path: a symlink entry that resolves outside the worktree and a regular-file entry containing the desired payload. When a Windows user performs an incremental checkout with symlink support enabled, gitoxide writes the symlink first, then follows it during the file write. The blob contents overwrite the linked target. Refer to the GitHub Security Advisory and the VulnCheck Path Traversal Advisory for exploitation details.

Detection Methods for CVE-2026-82248

Indicators of Compromise

Unexpected file modifications outside a repository worktree following a gitoxide-based checkout on Windows.
Repository trees containing duplicate path entries with both mode 120000 (symlink) and mode 100644 (regular file).
Reparse points inside a worktree resolving to sensitive system or user directories such as C:\Windows\System32 or %APPDATA%.

Detection Strategies

Inventory Rust binaries and services on Windows hosts that depend on gix-worktree-state versions below 0.33.0.
Scan cached and cloned repositories for tree objects that contain conflicting mode entries at identical paths.
Monitor process telemetry for gitoxide-based tools writing to paths outside their working directory during checkout operations.

Monitoring Recommendations

Enable Windows file system auditing on developer workstations and CI runners to record writes to sensitive directories.
Alert on symlink or reparse point creation by build agents and Git tooling processes.
Correlate repository fetch or checkout events with subsequent writes outside the expected worktree path.

How to Mitigate CVE-2026-82248

Immediate Actions Required

Upgrade gix-worktree-state and any dependent gitoxide crates to version 0.33.0 or later across all Rust projects and toolchains.
Audit CI/CD pipelines, package build systems, and developer workstations on Windows for tools that embed vulnerable gitoxide versions.
Restrict checkout operations on untrusted repositories until upgrades are verified.

Patch Information

The maintainers fixed the issue in gix-worktree-state0.33.0. Downstream applications must update their Cargo.toml dependency constraints and rebuild. See the GitHub Security Advisory GHSA-pmm9-4h7q-24c8 for the authoritative fix details.

Workarounds

Disable symlink support by setting core.symlinks = false in the Git configuration used by gitoxide-based tools on Windows.
Avoid incremental checkouts of untrusted repositories; perform initial checkout only into empty destinations (destination_is_initially_empty: true).
Run gitoxide-based tools under a least-privileged Windows user account without permission to write to sensitive directories.

bash

# Configuration example: disable symlink materialization for gitoxide-based tools
git config --global core.symlinks false

# Update the dependency in Cargo.toml to the patched release
# gix-worktree-state = ">=0.33.0"
cargo update -p gix-worktree-state