CVE-2026-110767
CVE-2026-110767 · Gitingest through 0.3.1 Arbitrary File Read via Symlink in Blob Ingestion
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Gitingest through 0.3.1 contains a symlink following vulnerability in ingest_query single-file blob ingestion that allows unauthenticated attackers to read server files by submitting symlink blob URLs. Attackers can commit a symlink to a public repository and submit its blob URL, causing the server to return any file the service user can read, up to 10 MB.
CVSS 8.7 · Alta · EPSS 0,4%
- Publicación
- Actualización
Productos y versiones afectados
gitingest
- Versiones
- ≥ 0, ≤ 0.3.1: Afectada (semver)
Sin corrección publicada
Fuentes originales
- https://hackmd.io/@hieuPenguinnn/gitingest-blob-symlink-arbitrary-file-read
- https://github.com/coderamp-labs/gitingest/blob/4e259a02fe72115bee538271622f1234a81c8e1a/src/gitingest/ingestion.py#L75
- https://github.com/coderamp-labs/gitingest
- https://www.vulncheck.com/advisories/gitingest-through-0.3.1-arbitrary-file-read-via-symlink-in-blob-ingestion
- https://nvd.nist.gov/vuln/detail/CVE-2026-110767