The gix-path crate version 0.10.8 on Windows can be tricked into executing a malicious git.exe placed in a fake Program Files directory by a limited user. This occurs because gix-path checks two hard-coded fallback paths for git.exe, including C:\Program Files (x86)\Git\mingw32\bin, which a limited user can create on 32-bit Windows systems. If the real git.exe is not found in the PATH, other users running applications using gix-path may execute the malicious git.exe, leading to potential privilege escalation. This vulnerability is fixed in version 0.10.9.