Description

gix-worktree-state before 0.33.0 (part of gitoxide) allows writing files outside the worktree on Windows. gix_worktree_state::checkout() follows an existing terminal symlink during non-exclusive (incremental) materialization (destination_is_initially_empty: false) when core.symlinks is true. If a symlink entry (mode 120000) is first checked out at a path P pointing outside the worktree, a subsequent incremental checkout of a regular-file entry (mode 100644) at the same path follows the existing reparse point and writes the blob content through the link, overwriting files outside the worktree.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-28T12:16:36.650Z",
  "pubdate": "2026-08-28T12:16:36.650Z",
  "executiveSummary": "A path traversal vulnerability exists in gix-worktree-state before version 0.33.0, a component of the gitoxide toolkit. The vulnerability arises from improper handling of symbolic links (reparse points) on the Windows platform during non-exclusive incremental checkout operations.\nThe flaw allows an attacker to overwrite arbitrary files outside the designated worktree boundary. An attacker capable of influencing the repository state or triggering an incremental update on a system where core.symlinks is enabled can escape the intended directory structure.\nThis vulnerability poses a significant risk to system integrity and confidentiality, as it enables unauthorized file modification, potentially leading to arbitrary code execution if executable files or configuration scripts are targeted.\nExploitation requires the victim to perform an incremental checkout of a malicious repository. The flaw is specifically tied to the state where the destination directory is not initially empty (destination_is_initially_empty: false), allowing the logic to inadvertently follow existing malicious reparse points rather than validating the target path.",
  "technicalDetails": "The vulnerability resides within the gix_worktree_state::checkout() function in the gitoxide framework. On Windows systems, when core.symlinks is configured as true, the checkout logic fails to correctly isolate filesystem operations to the root of the working directory during incremental materialization.\nThe root cause is a race condition or logic flaw in how the engine handles pre-existing files when destination_is_initially_empty is set to false. During an incremental checkout, if a path P is first populated with a symlink entry (mode 120000) that points to a target located outside the worktree, the system creates a reparse point at P. Subsequently, when the process attempts to checkout a regular-file entry (mode 100644) at the same path P, the implementation fails to verify whether the underlying target has been swapped or if it is currently resolving to a protected location.\nInstead of ensuring that the file operation remains contained within the repository bounds, the application follows the existing symlink/reparse point. Because the symlink was explicitly crafted to point to an external location (e.g., C:\\Windows\\System32 or user configuration directories), the file write operation is redirected. The blob content associated with the 100644 entry is then written to the arbitrary target path dictated by the previously existing symlink.\nThe attack flow is as follows: 1) The attacker commits a symlink to the repository that points to a sensitive location on the host filesystem. 2) The victim performs a non-exclusive checkout where this symlink is materialized. 3) The attacker updates the repository to include a regular file at the same path. 4) Upon the next incremental update, the engine executes the checkout of the blob content. 5) The system traverses the existing symlink, resulting in the overwrite of the target file.\nThis behavior affects gix-worktree-state versions prior to 0.33.0. No authentication is required to trigger the vulnerability once the malicious repository is processed by the local gitoxide-based application. The privileges of the file write are limited to the permissions of the user running the gitoxide-based tool, making this a critical concern for privileged users or services performing automated repository updates."
}