CVE-2026-128034
gittuf: File protection rules bypassed for filenames with special characters
CVSS Score
5.5
EPSS Score
0.0%
EPSS Percentile
0th
In gittuf before 0.18.0, verification of file protection rules uses the quoted, escaped pathnames that Git prints by default for files with special characters (for example non-ASCII characters) instead of the raw paths. Such paths do not match patterns like file:internal/*, so the files are treated as unprotected, and a user who is not authorized by a file protection rule can change a protected file whose name contains special characters and still pass verification.
| CWE | CWE-863 |
| Vendor | gittuf |
| Product | gittuf |
| Published | Nov 13, 2026 |
Stay Ahead of the Next One
Get instant alerts for gittuf gittuf
Be the first to know when new medium vulnerabilities affecting gittuf gittuf are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None
Affected Versions
gittuf / gittuf
0 < 0.18.0
References
Credits
Pratham Hegde Bhuvan Somisetty