CVE-2026-82248

gix-worktree-state before 0.33.0 (part of gitoxide) allows writing files outside the worktree on Windows. gix_worktree_state::checkout() follows an existing terminal symlink during non-exclusive (incremental) materialization (destination_is_initially_empty: false) when core.symlinks is true. If a symlink entry (mode 120000) is first checked out at a path P pointing outside the worktree, a subsequent incremental checkout of a regular-file entry (mode 100644) at the same path follows the existing reparse point and writes the blob content through the link, overwriting files outside the worktree.

• CWE-59

• https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-pmm9-4h7q-24c8
• https://www.vulncheck.com/advisories/gitoxide-before-0.33.0-path-traversal-via-symlink-following
• https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-pmm9-4h7q-24c8

Published

Aug 28, 2026

Last Modified

Aug 31, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-82242Budibase versions before 3.41.3 contain a missing authorizat…7.7
• CVE-2026-82243Budibase Server before 3.41.3 contains a server-side request…7.6
• CVE-2026-82244Budibase versions before 3.41.3 contain a remote code execut…9.1
• CVE-2026-82245Budibase before 3.41.3 fails to enforce role-based authoriza…8.1
• CVE-2026-82246Budibase Server before 3.41.3 contains a server-side request…7.1
• CVE-2026-82247gitoxide's gix-url crate (<= 0.32.0, fixed in 0.37.1) uses a…7.5
• CVE-2026-82249gitoxide before 0.38.2 fails to validate carriage return cha…3.1
• CVE-2026-8225A vulnerability was identified in Open5GS up to 2.7.7. This …7.5
• CVE-2026-82250gitoxide gix-packetline versions before 0.21.5 contain a pan…6.5
• CVE-2026-82251gitoxide before 0.52.1 fails to validate submodule names fro…7.5
• CVE-2026-82252gitoxide before 0.52.1 follows symlinks when reading the wor…7.5
• CVE-2026-82253gitoxide (Rust crates gix <= 0.72.0 and gix-validate <= 0.10…7.5