CVE-2026-123532 | BDVDB-2026-401889 Detail
GitoxideLabsgitoxide
Description#
gix-fs in gitoxide before 0.24.1 contains a credential disclosure vulnerability that allows remote attackers to capture NTLM credentials by supplying UNC symlink targets in a crafted repository. When a victim checks out the repository on Windows with symlinks enabled, gix_fs::symlink::create calls is_dir() on the UNC target, triggering SMB authentication that leaks the username, domain, and NTLMv2 hash.
Impact#
Per CVSS v3.1: confidentiality impact high, integrity impact none, availability impact none. Attack vector: network.
Weaknesses#
- CWE-59 Improper Link Resolution Before File Access ('Link Following')
References#
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.