Gitleaks up to version 8.30.1 creates the file specified by the --report-path flag with default file permissions, meaning the file is readable by any local user. Because the report contains plaintext secrets and the lines that matched it, other users on shared hosts or CI runners can read credentials and related context. The vulnerability is a classic example of an incorrect permissions weakness that leads to local disclosure of sensitive data rather than a remote attack vector.

The vulnerability affects the Gitleaks tool supplied by the gitleaks project, specifically any installation of version 8.30.1 that uses the --report-path option to output scan results. Versions earlier than 8.30.1 may also be vulnerable if the same code path exists, but the advisory explicitly references 8.30.1.

With a CVSS score of 4.8 the issue is considered moderate. No EPSS data is provided and it is not currently listed in CISA’s KEV catalog, indicating that no widespread exploits are known. Attackers would need local access or shared user rights to the host where Gitleaks runs; the fix is a local privilege escalation scenario that relies on reading the report file after the scan completes. The risk is amplified on multi‑user systems where the report directory is shared, but it does not allow remote exploitation or privilege escalation beyond local filesystem access.