CVE-2026-110767: Improper Link Resolution Before File Access ('Link Following') in coderamp-labs gitingest

CVE-2026-110767 describes an improper link resolution vulnerability in coderamp-labs' gitingest product, affecting versions up to and including 0.3.1. The vulnerability arises from the ingest_query functionality that processes single-file blob ingestion. Attackers can commit symbolic links to public repositories and submit blob URLs pointing to these symlinks. The server follows these symlinks and returns the contents of the target files, enabling unauthorized file disclosure of any file readable by the service user, limited to 10 MB in size.

An unauthenticated attacker can read arbitrary files on the server that the service user has read access to, potentially exposing sensitive information. The attack does not require privileges or user interaction and can be performed remotely. The maximum file size returned is 10 MB. This can lead to significant confidentiality breaches.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the gitingest service and monitor for suspicious blob URL submissions involving symlinks. Avoid exposing the service to untrusted users.