A flaw was found in gix-fs. An attacker can achieve arbitrary code execution by tricking a user into checking out a maliciously crafted repository. During forced checkout operations with file overwriting enabled, crafted symbolic links (symlinks) can bypass path validation and replace target directories, causing files to be written outside the intended working directory.
Last checked: 2026-09-28 15:29 UTC
Proof of concept · CISA Coordinator (Assessed 2026-09-28 13:05 UTC)
Fix evidence last checked: 2026-10-01 05:46 UTC