{"id":"CVE-2026-44471","sourceIdentifier":"security-advisories@github.com","published":"2026-05-13T22:16:46.057","lastModified":"2026-10-26T14:10:00.130","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"gitoxide is an implementation of git written in Rust. Prior to 0.21.1, a malicious tree can be constructed that will, when checked out with gitoxide, permit writing an attacker-controlled symlink into any existing directory the user has write access to. During checkout, all symlink index entries are deferred and created after regular files using a single shared gix_worktree::Stack. Internally, this uses a gix_fs::Stack. gix_fs::Stack::make_relative_path_current() caches validated path prefixes: when the previously-processed leaf component exactly matches the leading component(s) of the next path, the leaf-to-directory transition at gix-fs/src/stack.rs invokes only delegate.push_directory(), never delegate.push(). In gix_worktree::stack::delegate::StackDelegate, when the state member is State::CreateDirectoryAndAttributesStack, Attributes::push_directory() only loads attributes (from the ODB, in the clone case), and does not perform any other checks. The on-disk symlink_metadata() check and unlink-on-collision live in StackDelegate::push()'s invocation of create_leading_directory(), which is therefore bypassed for the cached prefix. The final symlink is created with plain std::os::unix::fs::symlink, which follows symlinks in parent directories. Therefore, it's possible to provide a tree with duplicate symlink and directory entries that exploits this. This vulnerability is fixed in 0.21.1."},{"lang":"es","value":"gitoxide es una implementación de git escrita en Rust. Antes de 0.21.1, se puede construir un árbol malicioso que, al ser extraído con gitoxide, permitirá escribir un enlace simbólico controlado por el atacante en cualquier directorio existente al que el usuario tenga acceso de escritura. Durante la extracción, todas las entradas de índice de enlaces simbólicos se posponen y se crean después de los archivos regulares utilizando una única gix_worktree::Stack compartida. Internamente, esto utiliza una gix_fs::Stack. gix_fs::Stack::make_relative_path_current() almacena en caché los prefijos de ruta validados: cuando el componente hoja procesado previamente coincide exactamente con el/los componente(s) inicial(es) de la siguiente ruta, la transición de hoja a directorio en gix-fs/src/stack.rs invoca solo a delegate.push_directory(), nunca a delegate.push(). En gix_worktree::stack::delegate::StackDelegate, cuando el miembro de estado es State::CreateDirectoryAndAttributesStack, Attributes::push_directory() solo carga atributos (del ODB, en el caso de clonación), y no realiza ninguna otra comprobación. La comprobación symlink_metadata() en disco y el desvinculado en caso de colisión residen en la invocación de create_leading_directory() de StackDelegate::push(), lo que, por lo tanto, se omite para el prefijo almacenado en caché. El enlace simbólico final se crea con std::os::unix::fs::symlink simple, que sigue los enlaces simbólicos en los directorios padre. Por lo tanto, es posible proporcionar un árbol con entradas duplicadas de enlaces simbólicos y directorios que explota esto. Esta vulnerabilidad se corrige en 0.21.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"GitoxideLabs","product":"gitoxide","versions":[{"version":"< 0.21.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-05-14T12:59:22.153707Z","id":"CVE-2026-44471","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-59"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitoxidelabs:gix-fs:*:*:*:*:*:rust:*:*","versionEndExcluding":"0.21.1","matchCriteriaId":"912E1255-11AA-48C2-B271-54138B01A00C"}]}]}],"references":[{"url":"https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-f89h-2fjh-2r9q","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]},{"url":"https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-f89h-2fjh-2r9q","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Vendor Advisory"]}]}