CVE-2026-100419

A flaw was found in gix-fs. An attacker can achieve arbitrary code execution by tricking a user into checking out a maliciously crafted repository. During forced checkout operations with file overwriting enabled, crafted symbolic links (symlinks) can bypass path validation and replace target directories, causing files to be written outside the intended working directory.

This vulnerability is rated as Moderate impact because exploitation requires user interaction to process an untrusted repository, restricting the potential blast radius to local file permissions rather than enabling direct remote execution. Within Red Hat products, the affected component is included as an underlying Rust library dependency in select tools rather than an exposed network daemon. Exploitation requires specific checkout parameters to overwrite existing target paths with crafted symbolic links, limiting exposure in automated and default workflows.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.