UBUNTU-CVE-2026-100419

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2026-100419

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-100419.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-100419

Upstream

CVE-2026-100419

Published

2026-09-25T22:17:00Z

Modified

2026-09-30T21:41:52Z

Severity

7.0 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
7.3 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Ubuntu - medium

Summary

[none]

Details

gitoxide gix-fs before 0.23.0 contains a path validation bypass vulnerability in the worktree checkout mechanism that allows attackers to escape the worktree directory via symlink manipulation. During forced checkout with overwrite_existing enabled, attackers can craft malicious repository trees where symlink entries replace validated directories, causing subsequent files to be written outside the worktree through the symlink for code execution or file manipulation.

References

Affected packages

Ubuntu:24.04:LTS / rust-gix-fs

Package

Name: rust-gix-fs
Purl: pkg:deb/ubuntu/rust-gix-fs?arch=source&distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.8.0-1

Ecosystem specific

{
    "binaries":  [
        {
            "binary_name":  "librust-gix-fs-dev",
            "binary_version":  "0.8.0-1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-100419.json"

Ubuntu:26.04:LTS / rust-gix-fs