8.8

CVE-2024-35186: byron gitoxide Relative Path Traversal

CVSS: 8.8v3.1HighDeferred
AliasesUBUNTU-CVE-2024-35186DEBIAN-CVE-2024-35186CGA-9qq9-h865-8j4x
Published 23-05-2024Last modified 02-08-2024
Open JSON

Vulnerability summary

CVE-2024-35186 is a high (CVSS 8.8) Relative Path Traversal vulnerability in byron gitoxide. EPSS estimates a 0.82% chance of exploitation in the next 30 days, higher than 56.5% of scored vulnerabilities.

Overall risk
35/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.8/10
010
High · v3.1 (CVE.org)
EPSS score
0.82%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 0 · Related 2
CGA-2FMX-8FHG-29PRCGA-R58C-CWV4-4PC9

Timeline

  1. 23-05-2024
    PublishedVulnerability first disclosed.
  2. 02-08-2024
    Last modifiedVulnerability information updated.

Description

gitoxide is a pure Rust implementation of Git. During checkout, `gix-worktree-state` does not verify that paths point to locations in the working tree. A specially crafted repository can, when cloned, place new files anywhere writable by the application. This vulnerability leads to a major loss of confidentiality, integrity, and availability, but creating files outside a working tree without attempting to execute code can directly impact integrity as well. This vulnerability has been patched in version(s) 0.36.0.

CVSS metrics

7 scores · 7 sources · 1 version

EPSS trend

Probability

0.82%

Chance of exploitation in the next 30 days

Percentile

57%

Versus all other CVEs

30-day change

0.00 pp

From 0.82% on 21-09-2026

21-09-202621-10-2026
EPSS score
0.82%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Crates.Io7 products
  • gitoxide< 0.36.0
  • gitoxide-core< 0.38.0
  • gix< 0.63.0
  • gix-fs< 0.11.0 | ≥ 0.0.0-0, < 0.11.0
  • gix-index< 0.33.0 | ≥ 0.0.0-0, < 0.33.0
Debian3 products
  • rust-gix-fs< 0.11.3-1
  • rust-gix-index< 0.33.1-1
  • rust-gix-worktree< 0.34.1-1
Byron1 product
Chainguard1 product
  • cargo-audit< 0.21.2-r1
Opensuse1 product
  • gitoxide&distro=openSUSE Tumbleweed< 0.36.0-1.1
Ubuntu1 product
  • rust-gix-fsAll versions (No fix recorded)
Wolfi1 product
  • cargo-audit< 0.21.2-r1

7 vendors · 15 products

References

16 links
Show all 16 references