The vulnerability in gitingest is a symlink following flaw in the single-file blob ingestion routine that permits an attacker to read non‑repository files from the server. By committing a symbolic link that points to any file the service user can read and then submitting its blob URL, the server exports the file contents to the requestor. The data can be up to 10 MB and the flaw is exploitable by unauthenticated users who have read access to the public repository containing the link. This flaw gives adversaries confidentiality exposure of arbitrary server files but does not provide remote code execution or privilege elevation on the host.

The bug affects all releases of gitingest up to and including version 0.3.1. The product is maintained by coderamp‑labs and is used in environments where repositories are processed through gitingest.

The CVSS base score of 8.7 indicates high severity, and the weakness type CWE‑59 reflects path traversal via symlink following. Although the EPSS score is unavailable, the vulnerability is not listed in CISA KEV, suggesting limited known exploitation yet. The likely attack vector is a web‑based ingestion request that is unauthenticated, meaning any attacker who can reach the ingestion endpoint can craft the malicious blob URL. Successful exploitation results in disclosure of arbitrary files readable by the service account, which may include sensitive configuration or code. The impact scope is potentially system‑wide if full filesystem access is granted to the service user. The absence of advanced access controls or symlink resolution checks in the ingestion logic makes exploitation straightforward once the attacker can introduce the symlink into a public repository.