CVE-2025-22620: gitoxidelabs gitoxide Improper Preservation of Permissions
Vulnerability summary
CVE-2025-22620 is a medium (CVSS 5.0) Improper Preservation of Permissions vulnerability in gitoxidelabs gitoxide. EPSS estimates a 0.37% chance of exploitation in the next 30 days, higher than 29.6% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 2 · Related 4Timeline
- 20-01-2025PublishedVulnerability first disclosed.
- 21-01-2025Last modifiedVulnerability information updated.
Description
gitoxide is an implementation of git written in Rust. Prior to 0.17.0, gix-worktree-state specifies 0777 permissions when checking out executable files, intending that the umask will restrict them appropriately. But one of the strategies it uses to set permissions is not subject to the umask. This causes files in a repository to be world-writable in some situations. This vulnerability is fixed in 0.17.0.
CVSS metrics
7 scores · 7 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated5.0MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
- OSV · DebianEcosystem advisory · calculated5.0MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
- OSV · WolfiEcosystem advisory · calculated5.0MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
- OSV · ChainguardEcosystem advisory · calculated5.0MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
- OSV · Crates.ioEcosystem advisory · calculated5.0MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
- NVDNIST5.0MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
EPSS trend
Probability
0.37%
Chance of exploitation in the next 30 days
Percentile
30%
Versus all other CVEs
30-day change
0.00 pp
From 0.37% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-281Improper Preservation of PermissionsThe product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.
- CWE-687Function Call With Incorrectly Specified Argument ValueThe product calls a function, procedure, or routine, but the caller specifies an argument that contains the wrong value, which may lead to resultant weaknesses.
Affected systems
Chainguard1 product
- cargo-audit< 0.21.2-r0
Crates.Io1 product
- gix-worktree-state< 0.17.0 | ≥ 0.0.0-0, < 0.17.0
Debian1 product
- rust-gix-worktree-state< 0.11.1-2
Gitoxidelabs1 product
- gitoxide< 0.17.0
Ubuntu1 product
- rust-gix-worktree-state< 0.11.1-2
Wolfi1 product
- cargo-audit< 0.21.2-r0
6 vendors · 6 products
References
11 links- github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-fqmf-w4xh-33rhX Refsource CONFIRMREPORTAdvisoryWEB
