Hi,

The following vulnerability was published for rust-gix-fs.

CVE-2026-100419[0]:
| gitoxide gix-fs before 0.23.0 contains a path validation bypass
| vulnerability in the worktree checkout mechanism that allows
| attackers to escape the worktree directory via symlink manipulation.
| During forced checkout with overwrite_existing enabled, attackers
| can craft malicious repository trees where symlink entries replace
| validated directories, causing subsequent files to be written
| outside the worktree through the symlink for code execution or file
| manipulation.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-100419
https://www.cve.org/CVERecord?id=CVE-2026-100419
[1] https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-6p9q-f2xg-6pr5
[2] https://github.com/GitoxideLabs/gitoxide/commit/b62498378b8bc2c95863a044b700f2063b0b5875

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
rust-gix-fs, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1149888@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Simon Quigley <tsimonq2@debian.org> (supplier of updated rust-gix-fs package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Fri, 16 Oct 2026 14:27:16 -0500
Source: rust-gix-fs
Architecture: source
Version: 0.24.0-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Rust Maintainers <pkg-rust-maintainers@alioth-lists.debian.net>
Changed-By: Simon Quigley <tsimonq2@debian.org>
Closes: 1149888
Changes:
 rust-gix-fs (0.24.0-1) unstable; urgency=medium
 .
   * Team upload.
   * Package gix-fs 0.24.0 from crates.io using debcargo 2.8.4
     (Closes: #1149888)
   * Drop relax-deps.patch; archive tempfile satisfies upstream 3.26.
Checksums-Sha1:
 f07d310ee84ef94c379cd3b7d4a0d01748277013 2628 rust-gix-fs_0.24.0-1.dsc
 e36be4bb614a822a2417aca47d4cda63e6e7524f 26285 rust-gix-fs_0.24.0.orig.tar.gz
 6bd6571674e11acd368d150d306741705c594ce2 3352 rust-gix-fs_0.24.0-1.debian.tar.xz
 8c4172ef02e9625f946005a7c7b6dec5d403da84 8342 rust-gix-fs_0.24.0-1_source.buildinfo
Checksums-Sha256:
 673e74c3e421371c647d488c59ae4907890a234104393f99150b2a2f6627eb56 2628 rust-gix-fs_0.24.0-1.dsc
 44a05d043e670c055cd8b53d078562dc0bc1e322bff6b0376b407d37cf72dcc5 26285 rust-gix-fs_0.24.0.orig.tar.gz
 20d2df7b211f6cb46e6111802a276f9a889c896483688481aa9ae47d5f13e64c 3352 rust-gix-fs_0.24.0-1.debian.tar.xz
 8639ad919534cfb96dfd120f953c936fdba2c9725021217074d6c6ff37cb255e 8342 rust-gix-fs_0.24.0-1_source.buildinfo
Files:
 bc8692d99db8bae2af2371b6f77fd501 2628 rust optional rust-gix-fs_0.24.0-1.dsc
 4bbbbcb0160b5cab099ca49bab849bda 26285 rust optional rust-gix-fs_0.24.0.orig.tar.gz
 5a29a661cab05da239c6535c26c8bcc0 3352 rust optional rust-gix-fs_0.24.0-1.debian.tar.xz
 3c8a126b1c7f5005ddafc496b1ecbd16 8342 rust optional rust-gix-fs_0.24.0-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEXHq+og+GMEWcyMi14n8s+EWML6QFAmrSgWwACgkQ4n8s+EWM
L6SGiBAAsaiOlsOVPBiA3YQkGyVzjT/gLM/x/sXJ2L3vLEBQdt0iuJwIxKlc3UB5
qCG/1mHNbl0sfRD6Bh9xO5R66atBYeT8UOtZgQVlUO8KetQhs5IQM9fFRus5IhXZ
u3fWRJ9Lh5Tar700qiZh9bxE1UQsUnD6VtZHBtaI9IMltQz4kmFMFftJjV+nnA6/
BtbJ0cgW87pl5O7yt4/a46CV6ll1RmYg64b0UYe8Ld8Bui4KRhCYLmtehNqS9psh
Me84XT5fTpQay0Dutt4H4MyzA2LuS4Om12gxezpXBI0jXz9z9UnIA3a/cmHgei+r
AALleOtSB/ihuq9nWNxVlPxAptgWDnj5Li+Lsi7gliRkn2+ZOBqDMuyWH7ieuBPD
F8BqUOZoi0zXmrqAoXc7HduCFG/rcvBzvlFigjGV+GmpzQ/xClo8AqoWXhqd7SBH
1RF8L2e1VtGeUobxsM/HuqJvSib2yVU9Jmv9+Xr0ipF2GA8A+6/MfqlszxOuEmke
aVW5uek7etoeLIVWlP5P2QNQrEfb5Kl1AdpBTRBSnsr/rONdS5VY4NpLyG3jPYfk
MW8wZLs5QVbX3A+9qls2QnHn3/lvAqSEBHs7C9nkS4YFX0hYJkJ4ls+kTru4yPiI
WBx7/k8Epn8rLNVW8PTYc0UHMZm5wgv/6pDdK3i4MOIoQrO68mg=
=2vA1
-----END PGP SIGNATURE-----