[From nobody Fri May 15 16:37:13 2026
Received: (at submit) by bugs.debian.org; 14 May 2026 21:34:59 +0000
X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02
 (2024-03-25) on buxtehude.debian.org
X-Spam-Level: 
X-Spam-Status: No, score=-9.9 required=4.0 tests=BAYES_00, FOURLA,
 FROMDEVELOPER, 
 NO_RELAYS,XMAILER_REPORTBUG autolearn=ham autolearn_force=no
 version=4.0.1-bugs.debian.org_2005_01_02
X-Spam-Bayes: score:0.0000 Tokens: new, 36; hammy, 150; neutral, 94; spammy,
 0. spammytokens: hammytokens:0.000-+--H*F:U*carnil,
 0.000-+--XDebbugsCc, 0.000-+--X-Debbugs-Cc, 0.000-+--HTo:N*Debian,
 0.000-+--H*Ad:N*Bug
Return-path: &lt;carnil@debian.org&gt;
Received: via submission by buxtehude.debian.org with esmtp (Exim 4.96)
 (envelope-from &lt;carnil@debian.org&gt;) id 1wNdhp-00Es2M-2A
 for submit@bugs.debian.org; Thu, 14 May 2026 21:34:58 +0000
Content-Type: text/plain; charset=&quot;us-ascii&quot;
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
From: Salvatore Bonaccorso &lt;carnil@debian.org&gt;
To: Debian Bug Tracking System &lt;submit@bugs.debian.org&gt;
Subject: rust-gix-fs: CVE-2026-44471
Message-ID: &lt;177879449667.822533.3327829164410711522.reportbug@eldamar.lan&gt;
X-Mailer: reportbug 13.2.0
Date: Thu, 14 May 2026 23:34:56 +0200
Delivered-To: submit@bugs.debian.org

Source: rust-gix-fs
Version: 0.16.1-1
Severity: grave
Tags: security upstream
X-Debbugs-Cc: carnil@debian.org, Debian Security Team &lt;team@security.debian.org&gt;

Hi,

The following vulnerability was published for rust-gix-fs.

CVE-2026-44471[0]:
| gitoxide is an implementation of git written in Rust. Prior to
| 0.21.1, a malicious tree can be constructed that will, when checked
| out with gitoxide, permit writing an attacker-controlled symlink
| into any existing directory the user has write access to. During
| checkout, all symlink index entries are deferred and created after
| regular files using a single shared gix_worktree::Stack. Internally,
| this uses a gix_fs::Stack.
| gix_fs::Stack::make_relative_path_current() caches validated path
| prefixes: when the previously-processed leaf component exactly
| matches the leading component(s) of the next path, the leaf-to-
| directory transition at gix-fs/src/stack.rs invokes only
| delegate.push_directory(), never delegate.push(). In
| gix_worktree::stack::delegate::StackDelegate, when the state member
| is State::CreateDirectoryAndAttributesStack,
| Attributes::push_directory() only loads attributes (from the ODB, in
| the clone case), and does not perform any other checks. The on-disk
| symlink_metadata() check and unlink-on-collision live in
| StackDelegate::push()'s invocation of create_leading_directory(),
| which is therefore bypassed for the cached prefix. The final symlink
| is created with plain std::os::unix::fs::symlink, which follows
| symlinks in parent directories. Therefore, it's possible to provide
| a tree with duplicate symlink and directory entries that exploits
| this. This vulnerability is fixed in 0.21.1.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities &amp; Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-44471
    https://www.cve.org/CVERecord?id=CVE-2026-44471
[1] https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-f89h-2fjh-2r9q

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore
]