CVE-2026-82248: Improper Link Resolution Before File Access ('Link Following') in GitoxideLabs gitoxide

The vulnerability exists in gix_worktree_state::checkout() in gitoxide before 0.33.0 on Windows. When performing a non-exclusive incremental checkout with core.symlinks enabled, if a symlink entry is first checked out at a path pointing outside the worktree, a later incremental checkout of a regular file at the same path follows the existing reparse point (symlink) and writes the file content outside the worktree. This improper link resolution allows unintended file writes outside the repository's worktree.

An attacker or user performing incremental checkouts with symlinks enabled can cause files outside the git worktree to be overwritten. This could lead to data loss or unauthorized modification of files outside the repository directory on Windows systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid performing incremental checkouts with core.symlinks enabled on Windows or avoid using affected versions if possible.