CVE-2026-100419
High
Description
gitoxide gix-fs before 0.23.0 contains a path validation bypass vulnerability in the worktree checkout mechanism that allows attackers to escape the worktree directory via symlink manipulation. During forced checkout with overwrite_existing enabled, attackers can craft malicious repository trees where symlink entries replace validated directories, causing subsequent files to be written outside the worktree through the symlink for code execution or file manipulation.
SeverityHigh
CVSS7.0
Exploit probability—
Product
Microsoft Azl3 Rust
PublishedSep 25, 2026
First seenSep 25, 2026
Weakness typeCWE-59Improper link resolution
How to fix
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| microsoft azl3_rust_1.96.1-2 | No range specified | — |
| microsoft azl3_rust_1.98.1-1 | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.