CVE-2026-110767

33th percentile - higher than 33% of all known CVEs

Gitingest through 0.3.1 contains a symlink following vulnerability in ingest_query single-file blob ingestion that allows unauthenticated attackers to read server files by submitting symlink blob URLs. Attackers can commit a symlink to a public repository and submit its blob URL, causing the server to return any file the service user can read, up to 10 MB.

An attacker can read any files accessible to the service user, potentially leading to leakage of sensitive information such as keys, configurations, or credentials.

Update Gitingest to a version later than 0.3.1 if available. Restrict the service user's permissions and avoid following symlinks when processing blobs.