CVE-2026-82248

Name of the Vulnerable Software and Affected Versions gix-worktree-state versions prior to 0.33.0

Description On Windows, the software allows writing files outside the worktree. This occurs when the gix worktree state::checkout() function follows an existing terminal symlink during non-exclusive incremental materialization (where destination is initially empty is false) while core.symlinks is enabled. If a symlink entry is first checked out at a specific path pointing outside the worktree, a subsequent incremental checkout of a regular-file entry at that same path follows the reparse point—a Windows object that redirects a file system operation to another target—and writes the blob content through the link, resulting in the overwriting of files outside the worktree.

Recommendations Update gix-worktree-state to version 0.33.0 or later.