Scadastrangelove

**Name of the Vulnerable Software and Affected Versions** gix-worktree-state versions prior to 0.33.0 **Description** On Windows, the software allows writing files outside the worktree. This occurs when the `gix worktree state::checkout()` function follows an existing terminal symlink during non-exclusive incremental materialization (where `destination is initially empty` is false) while `core.symlinks` is enabled. If a symlink entry is first checked out at a specific path pointing outside the worktree, a subsequent incremental checkout of a regular-file entry at that same path follows the reparse point—a Windows object that redirects a file system operation to another target—and writes the blob content through the link, resulting in the overwriting of files outside the worktree. **Recommendations** Update gix-worktree-state to version 0.33.0 or later.