The vulnerability is a path validation bypass in the worktree checkout process of gitoxide's gix‑fs module. By manipulating symbolic links within a repository, an attacker can cause files to be written outside the intended worktree during forced checkout with overwrite_existing enabled, potentially allowing arbitrary file writes or code execution. This weakness is categorized as CWE‑59, a path traversal issue that undermines directory confinement.

The issue affects GitoxideLabs' gitoxide project in all releases prior to version 0.23.0. Any systems employing those versions of the gix‑fs component are vulnerable.

The CVSS score of 7.3 indicates a high severity vulnerability. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an attacker providing a specially crafted repository that includes symlink entries or triggering a forced checkout with overwrite_existing set to true. Once the path validation is bypassed, the attacker can write files outside the worktree, potentially executing code or modifying critical files.