CVE-2026-44471: gitoxide Symlink Vulnerability Exposes Filesystem to Attack

The National Vulnerability Database has disclosed CVE-2026-44471, a high-severity vulnerability (CVSS 7.8) affecting gitoxide versions prior to 0.21.1. This flaw, categorized as CWE-59 (Improper Link Resolution Before File Access), allows an attacker to craft a malicious Git tree. When this tree is checked out with gitoxide, it enables the writing of an attacker-controlled symlink into any existing directory where the user has write access.

The vulnerability stems from gitoxide’s handling of symlink index entries during checkout. These entries are deferred and created after regular files, utilizing a shared gix_worktree::Stack and gix_fs::Stack. The gix_fs::Stack::make_relative_path_current() function caches validated path prefixes. When a previously processed leaf component matches the leading components of the next path, the system bypasses critical on-disk symlink_metadata() checks and unlink-on-collision logic. This bypass occurs because Attributes::push_directory() only loads attributes without performing other crucial security checks.

Attackers can exploit this by providing a Git tree with duplicate symlink and directory entries. The final symlink is created using std::os::unix::fs::symlink, which inherently follows symlinks in parent directories, leading to arbitrary file write. This means an attacker can plant a symlink pointing to sensitive locations, potentially leading to privilege escalation or system compromise. Defenders must prioritize patching to version 0.21.1 to mitigate this risk.